2022
-
Understanding access control
Mar 18
Every application that allows authentication requires a proven form of access control. It’s important to understand the different formats available.
-
A Libsodium-based secure remote password scheme for PHP
Feb 24
Let’s geek out on my favorite form of authentication – not sending passwords over the wire in the first place!
-
Securing tokens in PHP
Feb 21
Learn how password reset and other tokens can be secured by splitting the data and leveraging common password hash methodologies.
2020
-
Cracking the Uncrackable – Hashtopolis
Nov 30
In part 5 of our Bitcoin series, we leverage Hashtopolis to distribute a cracking operation across multiple independent machines.
-
Cracking the Uncrackable – Hashing Setup
Nov 23
When guessing passwords by hand isn’t enough, bring out the big guns: Hashcat. Extracting a hash from a Bitcoin wallet with bitcoin2john, setting up the attack — and why it can take until the next big bang.
-
Cracking the Uncrackable – Password Guessing
Nov 16
You set a password on your Bitcoin wallet, forgot it, and now Bitcoin has exploded in value. If you remember pieces (a few words, a birth year), btcrecover can build every likely combination from a token list and test each against your wallet.
2014
-
Debit Card (Lack of) Security
Nov 28
Debit card numbers have certain features to make them easy to produce. It also makes them easy to predict, allowing determined thieves to easily steal your money if you’re not careful.
-
WordPress 4.1 Includes a Session UI
Nov 14
My attempts to build a session UI over the weekend failed. My attempt to build one during a team hackathon was sidelined so we could focus on, what seemed at the time, far more interesting code. Now, though, I can jump on board with the new session UI being merged into WordPress 4.1!
-
WordPress, Security, and Member Management
Oct 15
If you’re logging in to WordPress as an administrator just to write a post, you’re doing it wrong.
-
Code, Credentials, and Public Repositories
Oct 8
Like most developers, I’m lazy. It’s easier to define a root-level constant with an API key or dashboard password than it is to program an interface for setting and storing those credentials. Unfortunately, it means I can very easily slip up and distribute those credentials to the world.