Passkeys are a new way to log in without passwords. They solve a lot of the traditional security risks associated with passwords. But passkeys are only secure if implemented well. When implemented incorrectly, they lead to new attack vectors that hackers can exploit.

In this talk, we will first study the protocol behind passkeys, called Webauthn. We will then look at some common implementation mistakes, and how we can exploit them. Next, we will present a methodology to carry out pentests on Webauthn implementations, and finally we discuss some vulnerabilities that we detected (and disclosed!) in various web applications.

This talk is based on joint research with Peizhou Chen (University of Twente).

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/WD99DB/

Love reverse engineering? You'd be right since you always find something interesting! In this talk we're going to study absolutely every byte of the DNA source of a real bacterium. And in doing so, we'll find bootstrapping code, genes, duplicate genes, anti-viral defense mechanisms, idiomatic/non-idiomatic/borrowed code & much more. It helps if you've also visited the companion talk on DNA, but this presentation is broadly accessible even without prior knowledge.

A typical bacterium has around one megabyte of DNA as its source code. And with our digital reverse engineering hat on, it turns out we can analyse this code and quickly learn things. Where do genes begin and end? What is the stuff between genes? How do bacteria bootstrap themselves? And, where do microbes store their immune system? Using digital skills, all this can be found just by looking at the DNA letters. And that is what we'll be doing in this talk.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/LUXFSP/

A brief retrospective over the past 16 years of organized voluntary repair initiatives and a look at the breakthroughs for the right to repair movement

When Martine Postma organized her first Repair-Café in Amsterdam, would she have imagined the kind of traction that her initiative would gain worldwide? With rampant enshittification of services, but also products ("planned obsolescence") comes resistance from consumers and politics. I'll show a few blatant examples and outline the recent progress in EU legislation.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/BDQESV/

Any even remotely advanced tasks on unixoid systems will inevitably lead to an encounter with one of the systems oldest components: The shell. An ancient artefact that is in equal parts being feared, mystified, or possibly even glorified.

In an effort to demystify origins, development, and current role of shells, this talk tells a tale deeply rooted in the earliest days of UNIX development. In the process, several (historic as well as current) shells will be introduced among their notable features and impact on contemporary systems. To finish of, the talk discusses the legacy of historic shells and their influence on modern operating systems with or without UNIX heritage.

While technical in parts, this is first and foremost a historical presentation with a bit of an outlook. Less tech-savvy audience members should thus still be able to enjoy this. In fact, newcomers to the shell may find some useful hints.

**Keywords:** *computing history; unix; multics; posix; linux*

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/CB7A9V/

During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth.

As electric vehicles become increasingly integrated into our transportation infrastructure, the security of their charging systems is becoming paramount. A threat actor hacking EV chargers at scale could have a real life impact on the continuity of our power grid and the transportation sector. Therefore, it is important that manufacturers and operators are well aware of their role in protecting our power grid.

During this talk we'll discuss the details on how we extracted the firmware, the vulnerabilities we found and the story of one drunk night of hacking till 07:00 AM in Tokyo that resulted in some much more high-impact vulnerabilities than were needed for the competition...

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/AGVUVM/

It started with a simple idea in 2016: make the state of security of our government transparent/public. The simple idea has become national government policy. Using transparency we've helped fix tons of security issues, reduce costs and increased control on IT. This year we've rolled out in Belgium and started measuring accessibility of websites in the same fashion. Learn how we've achieved extreme impact with a minimal budget and keep on doing so. Security and accessibility must be commodities.

(We're planning a couple of nice surprises during this talk exclusive for WHY2025. As always: it will make some people nervous, yet it will make society better.)

A transparent and accountable society creates trust. We're currently monitoring all important organizations in the Netherlands on about 25 security, privacy and sovereignty metrics. You can see openly where organizations are doing great or where they are even (unknowingly) breaking the law.

With the EU requiring accessibility on multiple sectors this year, we've also starting measuring accessibility in the same fashion. You can clearly distinguish organizations with and without an accessibility policy.

We'll show what it looks like, the impact it has, the awesome cyber tokens and certificates we make and the sets of open data we create.

The project is at its peak right now. If you want to make an impact on society: this is where it's at.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/3ZMKFQ/

A Domain-Specific Language is a computer language that’s made and suitable for a specific domain — *dûh*. But what happens when that domains is inhabited and operated by people that are – **gasp**! – not developers?! This is when a DSL has the opportunity to shine, and even outshine generic AI.

The field of Domain-Specific Languages has been going through a quasi-perpetual, reincarnating Gartner hype cycle for decades. Nevertheless, there are many DSLs out there, with many aimed squarely at software devs, and some at non-devs.

In this talk, I’ll explain what a DSL is and is made up of, and why you‘d want to make one – especially for non-devs! –, why and how to do that using something called “projectional editing”, why and how DSLs are better than AI, and why DSLs should be a standard tool in our dev-toolbox.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/LXNXVK/

IPv6 has been talked about a lot since a very long time. It never really caught on... or did it? Where are we right now? Where are we heading and what can you do about it?

What is the matter with IPv6? How did we go from something that was supposed to be the future of the internet to where we are today? Is it still like that? What plans are currently unfolding?

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/VBR7DQ/

You’ve released your code under a free license, but your project runs on proprietary platforms like Slack, GitHub, Notion, or Zoom. What’s the harm? In this talk, we’ll explore how relying on closed tools contradicts open source values, excludes contributors, locks your community into corporate ecosystems, and drives away idealistic contributors who care deeply about freedom. We’ll also tackle common justifications, like convenience or popularity, and show how they often mask deeper trade-offs.

My goal with this talk is to spark reflection and conversation about the tools we use to build open source projects, not just the code we write. I hope it encourages both new and experienced maintainers to think critically about how proprietary tools may be limiting their communities and values, even unintentionally. The audience will leave with a better understanding of the trade-offs involved, practical alternatives they can explore, and the motivation to make small changes that lead to more open, inclusive, and resilient projects. If more projects switch to even one open alternative, it strengthens the entire open source ecosystem by reducing dependency on tech giants and supporting community-owned infrastructure.

Whether you're starting a new project or maintaining a mature one, this talk will challenge you to think critically about the tools you use and advocate for open, community-controlled alternatives that align with the spirit of FOSS.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/WPGMJU/

Game randomizers can breathe fresh air into your favorite video games by changing where things are, what enemies you fight, or even what the win conditions are. But how do they work? Let's embrace chaos and learn about them!

Game randomizers can breathe fresh air into your favorite video games by changing where things are, what enemies you fight, or even what the win conditions are. But how do they work? In this talk, I'll share my experience building a randomizer for the Gameboy Advance version of Final Fantasy 1. I'll tell you about the stumbling blocks I hit, and how I solved them. I'll also share the lessons I learned building my project, and how I'd do it better next time.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/YXDFYP/