How DNSSEC Works (and Why Nobody Uses It)
DNSSEC is elegant cryptography with brutal operational reality. Two decades in, the vast majority of domains are still unsigned. The protocol isn't the problem.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Email Authentication: How Many Domains Actually Have All Five?
SPF, DKIM, DMARC, MTA-STS, BIMI — five standards, twenty years, and nobody can hand you a clean count of the domains that have all five. Every partial measurement points the same way.
The 12 HTTP Security Headers (and Which Actually Matter)
Not all security headers are equal. Some prevent real attacks daily. Some are legacy relics browsers ignore. Here's an honest priority list.
HTTP Security Headers: Who Actually Has CSP?
The gap between easy headers and hard headers is enormous. Most sites set X-Content-Type-Options and skip Content-Security-Policy. The data shows exactly how wide the gap is.
Let's Encrypt Changed the Internet (for Better and Worse)
Before 2015, HTTPS meant someone cared. After Let's Encrypt, HTTPS means the server exists. We got encryption everywhere and lost a trust signal nobody has replaced.
MCP: What It Means for Security Tools
Model Context Protocol gives AI agents a standard way to call security tools. The recon workflow is about to change. The judgment part isn't.
The Padlock Icon Should Be Removed from Browsers
The browser padlock creates false trust in hundreds of millions of users. HTTPS means encrypted, not safe. The icon should go.
Passkeys vs Passwords: The Transition That Keeps Stalling
Passkeys are technically superior in every way — phishing-resistant, no shared secrets, biometric-friendly. Apple, Google, and Microsoft all support them. Passwords are still the default almost everywhere.
Security Scores Are Meaningless
I build security scoring systems. I know better than anyone that they don't measure actual security. Here's why I keep building them anyway.
The SPF 10-Lookup Limit: A 20-Year-Old Mistake
RFC 7208 limits SPF to 10 DNS lookups. Exceed it and your email authentication silently breaks. The limit made sense in 2006. It doesn't anymore.
The TLS Handshake in 7 Steps
Every HTTPS connection starts with a negotiation most developers never think about. Here's exactly what happens in TLS 1.3, step by step — and how the older TLS 1.2 handshake differs.
Two-Factor Authentication Doesn't Solve Phishing
2FA stops credential stuffing. It barely slows down the real-time phishing proxies that are actually stealing sessions in 2026.