Topic

Research

15 posts

October 2026

The Username That Ate the Password: Argon2id, NIST SP 800-63B-4, and Storing Passwords in 2026 Between July and October 2024, an Okta login path accepted any password for some users, because bcrypt reads only the first 72 bytes of its input and a long username … Research 24 min read The Primary Key That Knew What Time It Was: UUIDv7, RFC 9562, and Choosing Identifiers That Age Well RFC 9562 replaced the 2005 UUID specification in May 2024 and added UUIDv7: a 48-bit Unix millisecond timestamp followed by random bits, so identifiers sort by creation … Research 28 min read The Login Link Landed in Spam: SPF, DKIM, DMARC, and the Year DMARC Became a Standard If your product signs people in with a one-time code or a magic link, email is part of your authentication system, and three DNS records decide whether that email … Research 30 min read The Instruction Was in the Ticket: Designing LLM Agents That Survive Prompt Injection EchoLeak, the GitHub MCP leak, and the Supabase support-ticket exfiltration all had the same shape: an agent read text an attacker wrote, and that text chose the agent's … Research 27 min read The Token That Published the Worm: Trusted Publishing, Sigstore, and Provenance After Shai-Hulud Shai-Hulud did not exploit npm. It read publish tokens out of developers' .npmrc files and environment variables, used them to push poisoned versions of the victims' … Research 27 min read

September 2026

The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read The Allowlist Was the Bug: Strict Content Security Policy, from Nonces to Trusted Types Most Content Security Policies in the wild do nothing against cross-site scripting. Google's 2016 study of 26,011 unique policies found 94.72% of them bypassable, mostly … Research 28 min read Secret Zero: How SPIFFE and the IETF's WIMSE Drafts Kill the Credential That Never Expires Every distributed system accumulates credentials that outlive the services they were minted for: an API key in a CI variable, a cloud access key in an environment file, a … Research 24 min read

August 2026

MCP Authorization: How the AI Agent Protocol Learned OAuth the Hard Way In its first four months, the Model Context Protocol asked every server author to build a miniature identity provider from scratch. It took a blog post, a security … Research 22 min read HTTP Message Signatures: How RFC 9421 Turned a Decade of Ad Hoc Signing Into One Spec Before February 2024, every API vendor invented its own way to sign an HTTP request: AWS built SigV4, Stripe and GitHub built timestamp-plus-HMAC webhook headers, and the … Research 23 min read

July 2026

Licenses That Can't Kill: Designing Commercial Licensing Without a Kill Switch Every runtime license check on a serving path is a kill switch someone else's outage, bankruptcy, or sanctions-compliance lawyer can pull. The documented record — … Research 21 min read The 202 That Tells You Nothing: Anti-Enumeration Engineering in Auth Systems Every difference between your system's answer for a user that exists and a user that does not is a database query an attacker runs for free. This post treats … Research 18 min read

June 2026

Signing Things That Must Outlive RSA: ML-DSA, Hybrid Signatures, and the Engineering of Long-Lived Trust A signature you verify today cannot be retroactively forged by a quantum computer built in 2035 — which is exactly why the signature migration is misunderstood. The … Research 20 min read Passkeys in Production: The Sharp Edges Nobody Puts in the Demo The WebAuthn demo takes an afternoon. Production takes a year, and the hard parts are nowhere near the ceremony code: an rp_id decision you cannot revise after launch, a … Research 20 min read OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read