Email Authentication: How Many Domains Actually Have All Five?
SPF, DKIM, DMARC, MTA-STS, BIMI — five standards, twenty years, and nobody can hand you a clean count of the domains that have all five. Every partial measurement points the same way.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
HTTP Security Headers: Who Actually Has CSP?
The gap between easy headers and hard headers is enormous. Most sites set X-Content-Type-Options and skip Content-Security-Policy. The data shows exactly how wide the gap is.
The Padlock Icon Should Be Removed from Browsers
The browser padlock creates false trust in hundreds of millions of users. HTTPS means encrypted, not safe. The icon should go.
Security Scores Are Meaningless
I build security scoring systems. I know better than anyone that they don't measure actual security. Here's why I keep building them anyway.
Two-Factor Authentication Doesn't Solve Phishing
2FA stops credential stuffing. It barely slows down the real-time phishing proxies that are actually stealing sessions in 2026.
"Zero Trust" Is a Marketing Term
Zero Trust started as a legitimate security architecture principle. It has been co-opted by every vendor to mean 'buy our product.' The original idea deserves better.