Data Safety and Information Security

Today’s world requires us to make complex and nuanced decisions about our digital security. Evaluating when to use a secure messaging app like Signal or WhatsApp, which passwords to store on your smartphone, or what to share on social media requires us to assess risks and make judgments accordingly. Arriving at any conclusion is an exercise in threat modeling. In security, threat modeling is the process of determining what security measures make sense in your particular situation. It’s a way to think about potential risks, possible defenses, and the costs of both. It’s how experts avoid being distracted by irrelevant risks or overburdened by undue costs...

The first six chapters of my new book, Dynamic Authorization: Adaptive Access Control, are now available in Manning’s Early Access Program. The book explores why authorization is still misunderstood, and how new tools like Cedar enable secure, flexible systems that also improve employee and customer experience.

For years, a European TLD ran their DNSSEC toolchain without incident. Everything “just worked.” Updates were rare, and no one touched the setup. Then their only DNSSEC expert left. What looked like stability turned out to be fragility. The system wasn’t resilient — it was dependent on one person’s

A look at vulnerable AI servers, especially self-hosted Ollama, and how to avoid that exposure.

Improving privacy can get overwhelming at first. It's important to move one step at a time, but remain persistent. Good privacy is like good health habits.

Keep applications secure with strong authentication security. Apply actionable steps and learn key takeaways to securing and building apps that elevate identity assurances.

Newgrounds, a gaming forum, has some clever ways for non-intrusively complying with the shambling disaster that is the "UK Online Safety Act". For years, I've been doing something similar to this when generating internal reports on DNA Lounge demographics: e.g., if someone bought a ticket for an 18+ event 5 years ago, they must be at least 23 years old now. Newgrounds: Here is our current ...

Several elliptic curves which Zcash uses in zero knowledge proofs are named after characters from Lewis Carroll: Jubjub, Bandersnatch, Tweddledee, Tweedledum

In Object Oriented programming, identity and behaviour are often conflated. But it can be usefuk to think of them as different concepts.

Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.

In the past few years, governments across the world have rolled out digital identification options, and now there are efforts encouraging online companies to implement identity and age verification

What do you do if it's too early to figure out fail2ban and need to stop crude bot attacks?

Authored by Boyi Wei Most frontier models today undergo some form of safety testing, including whether they can help adversaries launch costly cyberattacks. But many of these assessments overlook a critical factor: adversaries can adapt and modify models in ways that expand the risk far beyond the perceived safety profile that static evaluations capture.  At […]

While network protocols such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and SCTP (Stream Control Transmission Protocol)

Network Protocols: Beyond the Web's Horizon Software's communication capabilities extend far beyond the familiar confines of HTTP. Applications frequently

Data Structures: The Blueprint of Network Communication At the heart of every network protocol lies its data structures. These are the meticulously

Weigh the soul of incoming HTTP requests to protect your website!

Magic links, those emailed one-time login links, are annoying and inconvenient for folks who use a password manager, but they radically accept some fundamental truths about signing in for everyone else. By layering passkeys on top of magic links, websites can provide a seamless authentication experience for all users.

Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.

What we’ve learned the hard way: Isolation might be the most important primitive in distributed computing that we still haven’t gotten right.

Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report…

A cabal of Russian-nexus adtech companies are the cybercriminal choice to drive users to scams and malware from millions of compromised sites.

I often ask people: What’s the most important thing you need to have a successful fishing trip? I get a lot of different answers about bait, equipment, and boats. Some people tell me beer. Bu…

Abuse allows Meta and Yandex to attach persistent identifiers to detailed browsing histories.

Understand the common authentication methods used for NHIs, each method's architecture, typical use cases, and real-world security posture.

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been…

The Dangerous Illusion of Trustless Systems