Tag

Cryptography

5 posts

October 2026

The Username That Ate the Password: Argon2id, NIST SP 800-63B-4, and Storing Passwords in 2026 Between July and October 2024, an Okta login path accepted any password for some users, because bcrypt reads only the first 72 bytes of its input and a long username … Research 24 min read

August 2026

HTTP Message Signatures: How RFC 9421 Turned a Decade of Ad Hoc Signing Into One Spec Before February 2024, every API vendor invented its own way to sign an HTTP request: AWS built SigV4, Stripe and GitHub built timestamp-plus-HMAC webhook headers, and the … Research 23 min read

July 2026

Licenses That Can't Kill: Designing Commercial Licensing Without a Kill Switch Every runtime license check on a serving path is a kill switch someone else's outage, bankruptcy, or sanctions-compliance lawyer can pull. The documented record — … Research 21 min read

June 2026

Signing Things That Must Outlive RSA: ML-DSA, Hybrid Signatures, and the Engineering of Long-Lived Trust A signature you verify today cannot be retroactively forged by a quantum computer built in 2035 — which is exactly why the signature migration is misunderstood. The … Research 20 min read OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read

All posts