Security

Why Showing The WordPress Username Is A Security Risk

Apr 4

There have been a handful of discussions lately surrounding WordPress and usernames – particularly whether or not exposing usernames is a security risk. The consensus appears to be “no.” I beg to differ.

5 min · authentication · threat modeling

Democratizing SSL Certificates

Feb 28

I have an easier time trusting individuals and corporations I personally know than large companies with whom my only relationship is as a certificate vendor. I’m also a huge proponent of democratizing both publishing on the Internet and the Internet itself.

4 min · cryptography · privacy

Proper Code Styling

Feb 25

I look at a lot of code. In my job, recreationally on weekends. Everywhere I see people using a specific coding style and, upon pushback, defend it in the sake of brevity. I’m talking about braceless one-line conditionals.

3 min · code quality · developer tools

How Secure is the Internet of Things?

Feb 22

How secure are you? Really?

5 min · threat modeling · vulnerabilities

Data Leakage – Part 2

Feb 15

When you click a link on a page, your browser takes that page’s URL and sends it along with you as the “Referer” header. The site you end up on can then track exactly which sites are sending traffic. If your site is private (i.e. an internal company blog) and you link to an external…

3 min · data · privacy

Web Requests and Data Leakage

Jan 18

Even if your site is browsed over HTTPS, it can be insecure if any assets (images, scripts, styles) are transferred over an HTTP connection. This will trigger a “mixed content” warning in the browser that many will brush off as unimportant. The warning can be a major issue for some sites, though, and I want…

4 min · cryptography · privacy

Ethics in Software Development

Jan 14

Where do we, as software developers, draw the line with releasing new software? Do we build software with the common good in mind and ignore the potential consequences of releasing such tools to the world? Do we hold back potentially groundbreaking achievements because they could be misused by the wrong hands?

3 min · cryptography · ethics

WordPress Core Proposal: SUDO

Jan 8

Logging in to your WordPress site as an administrator when your plan is just to write is a bad idea. The admin user should be for administration and you should use an editor-level user for writing. But this dual-login workflow can be needlessly complicated on many sites. Instead, I propose we introduce a SUDO mode…

4 min · authentication · infrastructure

Photon and HTTPS – Making It Work

Jan 5

Jetpack’s Photon service doesn’t like it when image assets are served over SSL. I took some time to dig in to the issue and coded a quick workaround to enable Photon on a site locked down to serve all assets over SSL.

3 min · infrastructure · WordPress

Securing XML-RPC for WordPress

Jan 1

If you use WordPress, you’ve probably used one of the mobile apps for it. If you’ve used one of these mobile apps, then you’ve used XML-RPC. If you’ve used XML-RPC, then you’ve sent your username and password – in plain text – across the Internet. This is hugely unsafe, and I want to work to…

5 min · APIs · authentication