Security – Page 6 – Eric Mann's Blog

Birthdays and Three-way Hash Collisions

Sept 15

Let’s work out the probability that, in a given group of individuals, at least three share a birthday.

2 min · cryptography · data

Interesting Hacking Attempts

Aug 11

When someone hacks a plugin or theme, it’s bad. When someone hacks the foundation of those systems (WordPress), it’s worse. When someone hacks the base upon which WordPress is built (Apache, Nginx, or whatever server you use), it’s tragic.

2 min · infrastructure · vulnerabilities

WordPress Core Proposal: Session Management

Aug 6

When you log in to WordPress, the platform should record the event, where it occurred from, and the device that was used. This would empower you to kill off rogue sessions if necessary.

3 min · authentication · WordPress

They Should’ve Built it Better

Jul 22

Once I mastered the skill of lock-picking, it changed the way I looked at the world. Locked doors that used to obstruct me became mere annoyances. It was a bit of a dangerous revelation.

3 min · threat modeling

Device Security

Jul 15

How much control are we really giving up to anonymous developers with access to an update hook? How secure are our machines?

4 min · entrepreneurship · privacy

Physical Security

Jul 11

All of the encryption software in the world is meaningless if you fail to practice a couple of simple habits regarding physical security.

2 min · privacy · threat modeling

Self-Hosted VPN

Jul 10

I’m a stickler for security, so how can I in good conscience connect to a network I don’t trust?

5 min · cryptography · networking

Surprising Search Results

Jun 6

I found out that my top referrer so far this week is the search result page for “decrypt wordpress password hash online.” What’s going on?

3 min · authentication · infrastructure

Remote and Secure

Apr 24

A “virtual private network” is a way to keep your data secure, whether your on a dedicated 4G tether or connected to Starbuck’s free wireless. Traffic from your machine is encrypted at the machine, sent to a remote (trusted) server, decrypted, and proxied to the real network target.

3 min · networking · privacy

WordPress and Password Hashing

Apr 21

WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.

3 min · authentication · cryptography

Responsible Disclosure

Apr 10

For all the damage Heartbleed did on its own, disclosing the issue the way it was did far more good than harm.

4 min · ethics · vulnerabilities

Situational Awareness

Apr 7

How aware are you both of the objective dead ahead and of the potential vectors for surprises behind you?

4 min · guns · strategy