Posts to read for fun, like taking everything apart over a coffee to see what's inside, down to the deepest bolt. Come away understanding more, judging more clearly and deciding with a steadier hand.
A threat model for viet.sarl, a walk through every layer (Cloudflare, TLS, Caddy, cookies, tokens, Argon2id, OAuth, admin permissions, SQLite, SSH, secrets), common web vulnerabilities and how this site blocks them, what's still missing, and a checklist.
An SSH connection combines key exchange, a host key and a user signature. Looking at a real connection to GitHub using mlkem768x25519, known_hosts and trust on first use, ed25519 against RSA keys, ssh-agent, and a checklist for hardening a server.
OAuth is for authorization, OpenID Connect for authentication. Walking the authorization code flow with PKCE through viet.sarl's real code, the role of state, the kinds of token, why the implicit flow was dropped, and a small simulated authorization server showing what PKCE protects.
What each layer of encryption (disk, database, single column) stops and doesn't stop. Envelope encryption with a KMS, key rotation, blind indexes for lookups, an experiment encrypting an email column in SQLite, and why SQL injection still reads encrypted data.
TLS 1.3 combines hashing, symmetric encryption, key agreement and signatures into one handshake. Reading viet.sarl's real certificate chain, Let's Encrypt and ACME, Certificate Transparency, forward secrecy, HSTS, and the two TLS legs behind Cloudflare.
How to share a secret with a server you've never met. RSA and Diffie-Hellman by hand with small numbers, measuring RSA against Ed25519 for signing and verifying, equivalent key sizes, and the ML-KEM viet.sarl already uses against quantum computers.
If the database leaks, are the passwords still safe? Rainbow tables and salts, measuring SHA-256 at 4.3 million hashes/second against Argon2id at 44/second, estimating cracking time, a sign-in that doesn't reveal whether an email exists, and today's password policy.
The three properties of a hash function, why MD5 and SHA-1 were retired, collisions arriving early by the birthday paradox, measuring hash speeds, forging a sha256(key + data) signature with a length-extension attack, and comparisons that don't leak timing.
What security protects, what each of cryptography's three tools is for, why you don't hide the algorithm, and an experiment that predicts every output of random after seeing 624 numbers. The first post of the security series.