Color Selection "Game"

The Priv.ly Project's anti-spoofing glyph

When you visit a website that looks like your bank's, how do you know that you are actually talking to your bank and not a scammer impersonating your bank? Typically you will look at the address bar of the browser and compare it to the address you remember from the …

more ...



Compromising Combination Bike Locks

A Gigantic Bike lock in Burlington Vermont

A hazard of working in computer security is you see the world through a security-focused lens. Suddenly, mundane tasks transform into interesting intellectual challenges: "That card shuffle did not consume enough entropy!"..."Posting this online will open me up to social engineering!"..."People can learn my bike lock combination through …

more ...

Hacking a URL Shortener into a Comment System

Static HTML generators are fun to play with, but they (obviously) suffer from a lack of dynamic content. Today I experimented with using URL shorteners as a distributed hash table as a means of commenting on static sites.

After five hours of dealing with eccentricities of various URL shorteners, I …

more ...


Heartbleed: Should I Change My Password?

The web is rife with recommendations that users change their passwords following a catastrophic bug in the widely used cryptography suite OpenSSL. So the question is, should you change your password?

The short answer is: Maybe?

This particular security hole is scary because we have no way of knowing whether …

more ...

Securing User Content In The Javascriptable Web

My latest blog post appeared on O’Reilly Media’s programming blog.

Recent work by a W3 Working Group plans to expose many powerful cryptographic operations for web applications. Although the planned API adds much needed functionality to JavaScript, it doesn’t address the JavaScript runtime’s terrible security properties …

more ...

Cryptographic Thinking

Advocates for a national DNA identity database won a major victory with the Supreme Court’s recent decision to permit the routine collection and storage of DNA data. Justice Anthony M. Kennedy wrote for the majority,

When officers make an arrest supported by probable cause to hold for a serious …

more ...