Home
FIPS Background If you have ever waded into the alphabet soup of government regulations, you have probably stumbled across FIPS. FIPS stands for . These are cryptographic standards developed and maintained by the US government. In particular, FIPS 140-2 and the newer FIPS 140-3 define how cryptographic modules should be validated. Who actually cares about this? Federal agencies do. Defense…
What is a ghost login ? A is a legitimate authentication path that you forgot about or never noticed. Many SaaS apps allow several ways to sign in at the same time. Local username and password, social login, SAML / OIDC through your identity provider such as Okta and Entra ID. That combo is great for convenience and migration. It is also a perfect hiding spot. There are 2 main ways this occurs.…
Stop Calling it SSL. Seriously Yes you read that title right. If you are writing SSL in 2025 you are doing it wrong. That polite little acronym stuck around as a habit long after the protocol it named moved on. It is time to speak clearly and call things by their actual name which is TLS. All versions of SSL are now deprecated and should no longer be used. A short history of SSL and what it did…
Why I Hate Security through Obscurity I am not shy about this opinion. Security through Obscurity (StO) is the security equivalent of hiding a key to your house under the welcome mat and then being surprised when someone finds it. I hate security that depends on secrecy alone. I hate closed source secret protocols and proprietary encryption that you cannot audit. While I’m at it, I also hate…
Why Humans Are Often the Weakest Link in Cybersecurity 1. Evolving Tactics Cybercriminals are increasingly sophisticated. Rather than relying on obvious exploits, attackers use social engineering (phishing, voice manipulation, SIM swapping, etc) to trick trusted individuals into helping them with their attacks. 2. Advanced Social Engineering Techniques, Hypercharged With AI Spear-phishing : Highly…
The Power of Passphrases: A Better Approach to Password Security The conventional advice for passwords to use a complex string of random characters, but this is nonsense! Unreadable random characters will cause people to use short passwords like P@55w0rd! , or even worse write them down on a sicky note attached to the monitor. The strength of a password is measured in bits of entropy, which…
Welcome to the future 👋 It’s going to be great
Useful Software – A Linux distribution packed with penetration testing and security auditing tools. – A framework for developing, testing, and executing exploit code against target systems. – A tool that scans code repositories for exposed secrets like API keys and credentials. – A web vulnerability scanner and proxy tool for testing web application security. – A network protocol analyzer for…
The idea of a Uses page is to tell you about the stuff I use. Make sure to check out for a list of everyone’s Uses pages! If I get asked about what software or hardware I use this page will serve as a living document and a place to point curious readers to. Website : Static Site Generator : Code Repo : Hosting / Caching / Security OS Platform and browser I’m a polygot, and try not to…