Recent content on Brennenstuhl on Security
An organization with 500 engineering teams rarely has a single way to build, deploy, and operate services. It has a preferred path, a few tolerated exceptions, and a long tail of custom setups. Over time, local optimizations pile up on top of historical accidents. Now give every engineer multiple coding agents that produce code at machine speed. The inconsistency does not grow linearly. It…
On March 31, 2026, North Korean state actors compromised Axios , an npm package with over 70 million weekly downloads. Any project declaring axios@^1.14.0 connected to attacker C2 infrastructure the next time npm update ran. Six weeks later, a self-propagating worm hit 42 TanStack packages . It reached Mistral AI, UiPath, and OpenAI within hours. It also carried valid SLSA provenance attestations,…
Agentic engineering is collapsing the Software Development Life-Cycle (SDLC) into fast, autonomous loops. AI-augmented engineers ship code at a volume our security tooling and processes were never built for. Bartosz Ocytko recently mapped where agentic engineering is heading , pointing at bottlenecks in verification, open source, and compute. Reading his piece, one question stayed with me: what…
I recently migrated my personal JAMstack projects from Github and Netlify to European alternatives. In this article, I’ll share which European service providers I went for and why I sleep much better now. Before we begin, though, let’s quickly review what we mean when we use the term JAMstack ! What is JAMstack? A JAMstack is a software architectural approach that is solely based on…
Bunny.net launched the Bunny Shield Preview earlier this year. It’s an integrated Web Application Firewall (WAF), DDoS mitigation and rate-limiting controls solution all bundled into their Content Delivery Network (CDN) platform. I’ve been testing it on a few real-world projects over the last few weeks to see how ready it is and how easy it is to use. Spoiler: Bunny Shield is…
Although technically no longer necessary, the www subdomain is deeply ingrained in internet history and user habits. Redirecting root domains (like janbrennenstuhl.eu ) to its www subdomain ( www.janbrennenstuhl.eu ) offers benefits, especially when using a content delivery network (CDN) or caring about search engine optimization (SEO). In this article, I share three different approaches to…
Definition of JWA JSON Web Algorithms (JWA) is a specification providing a list of cryptographic algorithms. It’s an integral part of the JSON Object Signing and Encryption (JOSE) family of standards. JOSE includes, for example, JSON Web Tokens (JWT) , JSON Web Signature (JWS) , and JSON Web Encryption (JWE) . JWA provides definitions for several cryptographic algorithms. These algorithms…
TL;DR JWKS (JSON Web Key Set) is a tool for standardizing the representation and management of cryptographic keys via a JSON object. The technology, defined in RFC 7517, enables client-local JWT (JSON Web Tokens) verification and is integral for decentralized authentication protocols such as OpenID Connect and OAuth2 . Implementing JWKS simplifies key management, eases key rotation, and secures…
TL;DR JSON Web Encryption (JWE) is a standard for securing data transmission between parties, providing confidentiality, integrity, and authentication. It uses encryption to protect the payload of a JSON Web Token (JWT) and supports both symmetric and asymmetric encryption techniques. It also allows creating nested JWTs, combining the advantages of JWE and JSON Web Signature (JWS). A JWE token…
TL;DR OAuth 2.0 is an open standard that describes an authorization framework. It allows a third-party application to access a user’s resources without user credentials. JWT (JSON Web Tokens) is a standard that describes a JSON-based token format used to securely transfer information between two parties across an insecure environment. Combining OAuth 2.0 and JWT: JWT can be integral to the OAuth…
Disclaimer: This article involved collaboration with a GenAI tool for personal research. All content was reviewed and edited by myself. Feel free to report inaccuracies. Thanks. What is Whaling Cyber Awareness? Cyber security is an ever-evolving challenge requiring constant attention and effort to stay ahead of the game. One of the most significant threats companies face today is whaling cyber…
Disclaimer: This article involved collaboration with a GenAI tool for personal research. All content was reviewed and edited by myself. Feel free to report inaccuracies. Thanks. Whaling phishing is a cyber attack that targets high-profile individuals and key organizational staff. Attackers use social engineering tactics to trick victims into executing actions or disclosing confidential…
Security measures are effective when they cause the least friction while providing the highest level of security necessary for the targeted, user-friendly business process. Asking for too little gives users (or whoever is posing as them) too much freedom, but asking for too much, especially up front, generates obtrusive friction. Minimal friction is essential to success, especially in…
Introduction to Password Attacks Cybercriminals continuously seek new ways to gain account access and exploit security flaws as technology progresses. Password spraying is one such practice that, in recent years, has become popular among hackers looking to gain unauthorized access to accounts and sensitive information. But what exactly is password spraying, how does it work, and what can you do to…
Passkeys are currently on everyone’s lips, thanks to recent announcements to enable Passkeys for authentication on Google accounts. And, while the passwordless hype train did not stop in front of my desk either, there are some problems surrounding the imminent password killer, disregarded mainly by the relatively uncritical media coverage. In this essay, I’ll consider some of the biggest…
In the context of internet security, implementing passwordless authentication really is a game changer. Say goodbye to traditional, complicated, and insecure passwords! It’s time for us to investigate the myriad advantages of implementing passwordless authentication and understand why it’s necessary for improving cybersecurity. In this detailed introduction, I’ll delve deep into…
Strong passwords are necessary for securing user accounts and protecting sensitive data. As a frequent user of authentication systems and principal engineer for a single sign-on solution, I appreciate the necessity of delivering seamless user experience while emphasizing security. In this article, I’ll go over the advantages of long passwords, the obstacles for service providers of…
Today, digital security is more important than ever. With cyber threats on the rise, having strong, unique passwords is critical for protecting your accounts and data. Common sense among security researchers is, that longer passwords are more crucial than complicated ones. In this article, I’ll go into detail about the max password length recommendation, how it affects your digital security,…
Disclaimer: This article involved collaboration with a GenAI tool for personal research. All content was reviewed and edited by myself. Feel free to report inaccuracies. Thanks. TL;DR Honeytoken accounts are a tool that can help businesses detect data breaches. Creating a honeytoken account involves setting up canary traps by inventing sensitive data that appears legit PII. When a threat actor…
Importance of Password Policy Best Practices In today’s digital landscape, both password management and security are more important than ever before. With data breaches and cyberattacks on the rise, it’s crucial that organisations implement strong password policies to protect against credential stuffing, password spaying and related password attacks. However, designing a secure password policy…
Do you ever get tired of manually typing in your login credentials every time you need to access an online account? Luckily, there is a solution: password managers. These handy tools can automatically generate and store strong passwords, but they’re only truly useful if login forms are password-manager friendly. In this article, I explore how you can make your login forms more compatible…
As programmers, we probably use strings more than any other type of data structure. The cross-language String environment is characterized by shared vocabulary and well-established concepts. And it is especially important to follow these established naming conventions when it comes to null strings vs empty strings (and blank strings). With Apache Commons StringUtils and Hibernate Validator…
The demand for reliable and effective authentication methods has increased in the modern, distributed, and fast-paced digital world. Stateless authentication solutions are being used by developers and identity providers to deliver secure and scalable single sign-on solutions. JSON Web Token (JWT) are the new fancy kids around the block when it comes to transporting proofs of identity within an…
Often supporting open source software is just fixing one tiny thing you stumbled upon. However, getting ready and diving into even the smallest piece of source-code can lead to surprising results. I fixed a small HTTP header extractor for the Spring Security OAuth project recently. Here’s what happened. I fixed something for me At the very least, fixing this issue has made me happier. The…
Finally, I managed to come up with a name for my regular reading tips series which will feature both, latest info around recent events & incidents (especially when it comes to identity and security topics) as well as long running articles I strongly advice to read… it’s simply called Readme . The first issue of my Readme series features not just the latest Google Infrastructure…
Understanding JSON Web Tokens Welcome to the future of authentication! In a world where digital security is paramount, the need for robust and reliable authentication methods has never been more crucial. JSON Web Tokens are the new and fancy de-facto standard in the web. JWTs are the tool of choice when it comes to authentication in an stateless environment. That has two direct implications: You…
“Amazon DynamoDB is a fully managed NoSQL database service […]” . That’s what Amazon states in the DynamoDB FAQs . However, their definition is not quite what I would understand as fully managed. It’s missing counter-measures against the human error. For that reason, we need a DynamoDB backup and recovery solution, our DynamoDB safety-net… DynamoDB Threat…
AWS CloudFormation (CFN) is a file-based interface for provisioning AWS resources and in that way is Amazons answer on the ‘ Infrastructure as Code ’ paradigm. I am a huge fan of this approach and CFN is a big step into the right direction as it supports not just common DevOps ideas, by allowing devs to create, update and delete the operational infrastructure they need with their own…
Microservices have revolutionized the way we develop and deploy software applications. But with great power comes great complexity. As microservices become more and more ubiquitous, developers must grapple with new challenges, such as managing dependencies, ensuring scalability, and maintaining consistency across services. In this article, I take a deep dive into the evolution of a microservice,…
Using Python Docopt (for beautiful command-line interfaces) I recently had the problem of converting a list of tuples into a dictionary. In this post I’d like to document the solution … 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 ''' usage: mytool [options] options: --foo-bar=PARAM1,PARAM2,... params to do stuff with [default: key1.value1,key1.value2,key2.value2] '''…
Today I’d like to share my solution for a common problem a lot of IT companies experience when finally moving from Subversion (SVN) to Git as their central version control system (VCS): Converting a SVN repository into a Git repo including its commit history and authors. To achieve this, I decided to split this issue into smaller pieces: Extracting all authors of the SVN repository, Creating…
On Github, every organization with a fast growing open-source codebase quickly figures out a couple of shortcomings regarding the Github web interface. Especially, when it comes to Github organizations that are already around for some time, you often find some information missing that could probably help managing and controlling your organizations repositories… Github & Licenses For months…
With Ireland and Frankfurt being available as AWS regions nowadays, Amazon (more or less) tried to extinguish EU and especially German legal concerns regarding storage and processing of privacy-related data. However, for European companies it remains difficult to prevent (accidental) usage of services and resources outside the EU, as there is still no standardized way to restrict AWS-account…