Web security
Security Headers Graded: We Checked 100 Developer Tool Sites
Over half the tools you use to build software scored a C or worse on their own security headers.
Kief Studio
Web security
DNS, certificates, headers and the small pieces of crypto that leak when they're wrong.
Web security
AES-256-GCM in Node.js: Encrypting PII the Right Way
Most AES-GCM code on the internet is wrong. Not "suboptimal" wrong. Not "could be better" wrong.
Kief Studio
Web security
Timing-Safe String Comparison: Why Your Auth Is Probably Leaking Data
Your == operator is a snitch. Every time your code compares a password hash, API key, or webhook signature using standard string equality, it leaks information.
Kief Studio
Web security
How to Read SSL Certificate Chains (And Why You Should)
Your site works in Chrome on your laptop. The padlock is green. Everything looks fine. Then a webhook fails. A mobile user gets a security warning.
Kief Studio
Web security
DNS Lookup Deep Dive: What Every Record Type Actually Means
You set up DNS once, mass-pasted some records your hosting provider told you to add, and never looked again. That was fine in 2020. It's not fine now.
Kief Studio