Content Security Policy: Putting the Browser on a Security Diet
Web applications have become remarkably powerful.
Read article: Content Security Policy: Putting the Browser on a Security DietSecurity
103 articles tagged Security.
The Digital Dead: Existence Beyond Death Online
I started thinking about this post a while back when I saw a former colleague’s Medium profile still listed as following mine. He died in the early days of covid. A quick check showed that his LinkedIn profile seems to have disappeared — not sure how that works. It was still there a few years ago.
Read article: The Digital Dead: Existence Beyond Death Online
PKCE: Proof Key for Code Exchange
One of the biggest misconceptions about OAuth2 is that it is a single protocol. In reality, OAuth2 has evolved considerably over the years as new attack vectors have been discovered and new security mechanisms introduced. One of the most significant of these improvements is Proof Key for Code…
Read article: PKCE: Proof Key for Code Exchange
DPoP: The Missing Security Layer in OAuth2 and OID4VCI
OAuth2 has long suffered from a fundamental weakness: bearer tokens.
Read article: DPoP: The Missing Security Layer in OAuth2 and OID4VCI
Elliptic Curve Cryptography: The Tiny Keys That Protect the Internet
If you’ve spent any time reading about modern cryptography, you’ve probably encountered the phrase Elliptic Curve Cryptography (ECC). It sounds less like a security technology and more like an elective mathematics course that everyone regrets taking — I’ve been in several of those.
Read article: Elliptic Curve Cryptography: The Tiny Keys That Protect the Internet
Secure Code Reviews: Finding Security Issues Before Attackers Do
For most corporate IT workshops, we are often trying to abstract as many security details away from application code as possible. I understand things may work differently at Big Tech / shops-with-many-competent developer resources. I initially started jotting down notes for this blog post while I…
Read article: Secure Code Reviews: Finding Security Issues Before Attackers Do
Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated User
Authentication is one of the most fundamental concepts in application security. Most developers spend considerable time designing how authenticated users are represented, authorized, and managed. Surprisingly, much less attention is given to the opposite state of users who have not authenticated at…
Read article: Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated User
Data Loss Prevention (DLP): Keeping Your Organization’s Secrets from Walking Out the Door
For decades, organizations have focused on keeping attackers out. Firewalls, antivirus software, intrusion detection systems, IAM solutions, and the like all serve a common purpose to prevent unauthorized access. However, many security incidents do not begin with an external attacker breaking in.…
Read article: Data Loss Prevention (DLP): Keeping Your Organization’s Secrets from Walking Out the Door
Sweden’s Cashless Revolution: The Hidden Costs of a Digital Economy
In my “Dangers of a Cashless Society” post, I briefly described my experiences in Sweden. This post expands on that.
Read article: Sweden’s Cashless Revolution: The Hidden Costs of a Digital Economy
Post-Quantum Cryptography (ML-KEM): The Math
ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), formerly known as CRYSTALS-Kyber, is the post-quantum key exchange algorithm standardized by National Institute of Standards and Technology as FIPS 203. Its security is based on the difficulty of certain problems in lattice cryptography,…
Read article: Post-Quantum Cryptography (ML-KEM): The Math