Jon Oberheide is a board member, startup adviser and investor focused on cybersecurity and enterprise software. He co-founded Duo Security and served as its CTO, following security research at the University of Michigan.[1]
Start with Automating a YubiKey for Agentic Logins →
Education
Links
Jon Oberheide: personal site LinkedIn
X · jonoberheide Board member · DNSFilter
Board member · Push Security
Board member · GC AI
Career
Oberheide completed BS, MS and PhD degrees at the University of Michigan. His research page identifies the doctorate as computer science and names Farnam Jahanian as adviser. At Duo, his work as co-founder and CTO centered on making enterprise security easy to use and effective. Cisco acquired the company. His current personal site lists board work with GC AI, DNSFilter and Push Security, alongside nonprofit and university service.[1][3]
Contributions
A hardware bridge for an awkward login
In his YubiKey article, Oberheide describes a personal automation that needed to log in to a portal without a usable API. He relayed a browser’s authentication challenge to a hardware key on a physical host, then used a Raspberry Pi Pico and a reed relay to trigger its capacitive touch sensor. The key still performs the cryptographic signing; the custom hardware automates the user-presence step. He describes controls restricting the requesting automation and allowed origins. It is a specific workaround for his system, not a general delegated-authentication protocol.[2]
Cloud services as security infrastructure
His doctoral research, titled Leveraging the Cloud for Software Security Services, examined using cloud infrastructure for security services. The research archive connects this academic work to later talks about enterprise security, usability and zero trust.[3]
Tools, writing & talks
Writing, research & talks
Start here
Automating a YubiKey for Agentic Loginsjon.oberheide.orgA detailed account of bridging browser automation to a hardware security key and electronically triggering its touch sensor.
Start with the YubiKey article for a concrete example of his security engineering. Basic browser-login and public-key authentication knowledge helps; focus on the trust boundaries and why he needed a physical component.
Author and builder of the described setup[2]Original source- Research archivejon.oberheide.org
Papers and talks spanning software security services, mobile security, enterprise usability and zero trust.
Researcher, author and speaker[3]