Posts tagged “security”
17 posts Subscribe by RSS
17 posts
TLS Certificate Name Mismatch: What a Client Actually Compares (RFC 9525)
What a TLS client compares with the certificate's SAN under RFC 9525: reference identifiers, DNS-ID and IP-ID, the Common Name ban, wildcards, mismatch handling, and a checklist.
What Referrer-Policy puts in Referer: the full URL, the origin, or nothing
Referrer-Policy decides what goes in Referer when a page loads an image or follows a link. The eight values, what is always stripped, where the policy is set, redirects and the Origin header.
What WebAuthn signCount tells you: the counter check and clone signals
Per WebAuthn Level 3: what signCount counts, when it stays at zero, the exact comparison an RP runs, why a lower or equal value is a signal rather than proof, and how the BE and BS flags relate.
What REA can do, what it can do only under conditions, and what it does not support
A capability matrix for REA from its docs at a pinned commit: built-in static paths, paths that need a provider or change state, unsupported targets, and how to read Evidence and its unknowns.
Getting started with REA safely: a first exercise, a team checklist and a 30/60/90-day path
What to know first, a low-risk first investigation on the official Notes fixture, a checklist for teams, proposed success gates and a 30/60/90-day pilot with conditions for stopping.
What recent REA write-ups actually tested: runs, demos, news and opinion
Eight third-party pieces on REA, sorted by who ran what: two independent runs, two author-claimed demos, three news or opinion pieces and one discussion thread, and what each one can support.
REA's strengths and their costs, and five scenarios for the next 12 to 24 months
Each REA strength comes with a cost from the same design. Six pairs, who gains, and five conditional scenarios with counter-scenarios and signals to watch. Analysis, not a forecast.
REA (Reverse Engineer Anything): how it connects agents to analysis tools, what to learn, what to watch
What REA is and isn't, the agent-assisted investigation loop, the background worth having and a learning route, and the safety and rights boundaries, based on the project's official docs.
What HSTS stops and what it doesn't: max-age, includeSubDomains, preload
What a browser does after receiving Strict-Transport-Security, per RFC 6797: the first-visit gap, the upside and risk of includeSubDomains, staged max-age, and why preload is no longer recommended.
When is a hash table not O(1)? Collisions, O(n²) inserts and hash flooding
dict and HashMap are O(1) in expectation. Why n keys with one hash value need at least n(n−1)/2 comparisons. Python hash randomization and PYTHONHASHSEED, Rust's SipHash, Java's Comparable fallback.
Why a JWT verifier shouldn't trust alg: none, RS256→HS256 confusion and algorithm pinning
A JWT's alg header is chosen by the token's sender. Why alg none and RS256→HS256 confusion work, what RFC 8725 requires (one algorithm per key), and the iss, aud, exp, typ checks that follow.
OAuth 2.0 PKCE: Making an Intercepted Authorization Code Useless
How PKCE's code_verifier and code_challenge stop authorization code interception: S256 math, server checks, why plain and downgrades fail, where state matters, and what PKCE does not cover.
How an authenticator app's 6-digit code is made: TOTP step by step
How your authenticator app's code matches the server without asking it, traced through the RFC test values: time steps, HMAC, dynamic truncation, server checks, and the phishing gap.
401 vs 403: missing authentication or a refused request
How HTTP 401 Unauthorized and 403 Forbidden differ under RFC 9110 and the OAuth 2.0 Bearer Token spec: WWW-Authenticate, retry rules, and hiding a resource with 404.
X-Frame-Options vs CSP frame-ancestors: which clickjacking header wins when you send both
How the two headers that stop your pages being framed differ, per CSP Level 3 and the HTML Standard: which one wins when both are sent, why ALLOW-FROM is ignored, and why a meta tag won't work.
What a hash function does: SHA-256, checksums and password storage
Why SHA-256 is always 64 hex digits, why one changed letter changes everything, how hashing differs from encryption and encoding, checking downloads, and why fast hashes are wrong for passwords.
Length beats symbols: measuring password strength in bits
Why a password that passes every uppercase-digit-symbol rule can still be weak, how to measure strength as entropy, passphrases, what NIST now recommends, and why a second factor matters more.
No posts match. Try another word.