Defconの新バッジは中身が見える「セキュリティキー」Defcon's new badge is a security key you can see inside

Defcon, the long-running hacker gathering held each summer in Las Vegas, has unveiled a 2026 conference badge designed to function as a real hardware security key rather than a disposable novelty. The design matters because it addresses two things the security community cares about deeply: hardware that outlives the event it was made for, and transparency into what that hardware actually does.

According to the description, the badge includes a removable chip that attendees can detach to inspect the internals of their badge. Rather than becoming a shelved souvenir after the conference ends, the device is meant to keep working as a functional authentication token, an actual security key that people can register with online accounts and continue to use in daily life.

Hardware security keys are physical devices used for phishing-resistant multi-factor authentication. Under standards developed by the FIDO Alliance, such as FIDO2 and the related WebAuthn specification, a key stores cryptographic secrets and proves a user's identity to a website or service without transmitting a reusable password. Commercial examples include Yubico's YubiKey line and Google's Titan keys. Making a conference badge that speaks the same protocols means, at least in principle, that attendees leave with a working authenticator instead of a keepsake.

The removable-chip approach is notable for an audience predisposed to distrust closed hardware. Security keys are, by design, small black boxes that users are asked to trust with sensitive credentials, and supply-chain integrity is a recurring concern at events like Defcon. Letting owners physically remove and examine the component that handles authentication appears intended to invite exactly the kind of scrutiny this crowd enjoys, from reverse engineering and teardowns to independent verification of what the silicon is doing.

The badge also fits a well-established Defcon tradition often called "badgelife." For years, official and unofficial badges at the conference have been elaborate electronic artifacts, featuring circuit boards, microcontrollers, LEDs, puzzles, and games, and they have spawned a subculture of hardware hackers who design, trade, and modify them. Turning that creative energy toward a device with a practical post-conference use is a logical extension of that culture, giving the badge utility beyond the challenge and collectible value it normally carries.

The move arrives as the broader industry pushes toward passwordless authentication. Major platform vendors, including Apple, Google, and Microsoft, have promoted passkeys, a consumer-friendly application of the same FIDO2 and WebAuthn foundations, as a replacement for passwords across phones, browsers, and operating systems. Standalone hardware keys remain a stronger option for users who want credentials tied to a dedicated physical device rather than synced through a cloud account, and they are widely used by journalists, activists, and enterprise security teams.

Details about the badge's exact specifications, the standards it supports, and how many will be produced were not fully described in the initial announcement. As with prior Defcon hardware, the final product's capabilities and any limitations will likely become clearer once attendees receive the badges and begin dismantling and documenting them, as the community reliably does. It is also worth noting that a device intended as a real security key would need to reliably protect its stored secrets to be trusted for sensitive accounts, and independent review is the usual way such claims get tested.

Still, the concept captures something specific about Defcon's ethos: hardware you are encouraged to open, inspect, and question rather than take on faith. If the badge works as described, it offers attendees a rare combination, a conference collectible that is also a genuinely useful tool, while inviting the community to verify those claims for itself long after the event in Las Vegas has ended.

For anyone who follows the badgelife scene, the more interesting test may come in the weeks after the conference, when teardown photos, firmware analysis, and compatibility notes typically circulate online. That collective examination tends to determine whether an ambitious badge is remembered as a clever gimmick or as a piece of hardware worth keeping on a keychain.