TLS

Secure WebRTC signaling, TURN relays and media servers

WebRTC encrypts media, but signaling decides whose keys you trust and TURN relays wherever it is allowed. Authorize every signaling message, mint short-lived TURN credentials, deny internal addresses and harden media servers.

Design, Development · Developers, Platform engineers and SREs

Configure HTTP security headers from a tested baseline

Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.

Development · Developers

Consume third-party APIs safely (OWASP API10:2023)

Treat every upstream and third-party API response as untrusted input: validate it against a schema, set connect and read timeouts, cap the response size, refuse to follow redirects blindly, keep TLS verification on, and scope the credentials you hold for each provider.

Design, Development · Developers, AppSec engineers

Worked threat model: a mobile banking app

A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.

Design · AppSec engineers

Prevent subdomain takeover from dangling DNS records

A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.

Release, Maintenance · Platform engineers and SREs

Authenticate workloads and authorize their service actions

Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.

Release, Maintenance · Platform engineers and SREs

RC4 keystream bias

Understand why fresh RC4 keys do not remove keystream bias and how repeated secret positions turn a small statistical effect into evidence.

Design, Development · Developers

Lucky Thirteen and POODLE: two different oracles

Compare two CBC oracles by their signal, protocol rules, and attacker prerequisites instead of treating them as interchangeable padding bugs.

Design, Development · Developers

FREAK and Logjam: export-grade key exchange

Trace two export-grade downgrade paths and separate RSA factorization from finite-field Diffie–Hellman discrete logarithms.

Design, Maintenance · Developers

DROWN: one RSA key across incompatible protocols

Map an RSA key across services to see how an SSLv2 oracle could compromise TLS traffic on a different endpoint.

Design, Development · Developers

Sweet32: the cost of a small block size

Read the 2016 Sweet32 demonstrations as evidence about traffic volume, repeated secrets, and session lifetime rather than treating a block-size threshold as an instant exploit.

Design, Development · Platform engineers and SREs

Operate TLS and certificates: configuration, renewal and verification

Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.

Design, Maintenance · Developers, Platform engineers and SREs

Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines

Inventory public-key cryptography by operation, owner and lifetime, turn on hybrid ML-KEM key exchange where it is already available, and plan signature and archive migration against the NIST, NSA, NCSC and EU dates.

Design, Maintenance · AppSec engineers

Choose cryptographic algorithms and parameters by job

A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.

Design, Development · Developers

Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot

How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.

Maintenance · Developers, AppSec engineers, Platform engineers and SREs

CSP builder lab: Build a strict Content-Security-Policy

A page sends a Content-Security-Policy whose script-src allows any HTTPS origin, so an injected external script runs despite the nonce. Repair the builder so it produces a strict nonce-based policy from the document’s declared needs.

Insecure randomness lab: Generate unguessable API keys

An integration service issues 16-character API keys from Math.random, which is not built to be unpredictable. Take every character from the system’s secure generator, lengthen the key and map bytes without bias.

Improper TLS certificate validation

TLS protects a connection only if the client checks who is at the other end.