2022
-
Understanding access control
Mar 18
Every application that allows authentication requires a proven form of access control. It’s important to understand the different formats available.
-
A Libsodium-based secure remote password scheme for PHP
Feb 24
Let’s geek out on my favorite form of authentication – not sending passwords over the wire in the first place!
-
Securing tokens in PHP
Feb 21
Learn how password reset and other tokens can be secured by splitting the data and leveraging common password hash methodologies.
2014
-
Debit Card (Lack of) Security
Nov 28
Debit card numbers have certain features to make them easy to produce. It also makes them easy to predict, allowing determined thieves to easily steal your money if you’re not careful.
-
WordPress 4.1 Includes a Session UI
Nov 14
My attempts to build a session UI over the weekend failed. My attempt to build one during a team hackathon was sidelined so we could focus on, what seemed at the time, far more interesting code. Now, though, I can jump on board with the new session UI being merged into WordPress 4.1!
-
WordPress, Security, and Member Management
Oct 15
If you’re logging in to WordPress as an administrator just to write a post, you’re doing it wrong.
-
Security, Legal Bypass, Warrants, and Apple
Sept 21
Apple has announced they won’t be unlocking iOS 8 phones in response to warrants, not as a point of policy, but because the system they’ve built won’t allow it.
-
WordPress Core Proposal: Session Management
Aug 6
When you log in to WordPress, the platform should record the event, where it occurred from, and the device that was used. This would empower you to kill off rogue sessions if necessary.
-
Surprising Search Results
Jun 6
I found out that my top referrer so far this week is the search result page for “decrypt wordpress password hash online.” What’s going on?
-
WordPress and Password Hashing
Apr 21
WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.
-
Why Showing The WordPress Username Is A Security Risk
Apr 4
There have been a handful of discussions lately surrounding WordPress and usernames – particularly whether or not exposing usernames is a security risk. The consensus appears to be “no.” I beg to differ.