Protocols, security incidents, and how the internet actually works. 147 posts.
To save a round trip, your browser lets a server recognize it on the next visit — at the TLS layer, below the cookie jar. For years that optimization was a supercookie, and the story of how it got fixed is a lesson in where identity really leaks.
TLS 1.3 made almost everything safer. Then it added 0-RTT early data, which is replayable by design — and the standard way to make it 'safe' rests on a promise most apps break.
Plenty of HTTPS sites serve an incomplete certificate chain. They work in Chrome anyway — because Chrome quietly downloads the missing piece. Every client that doesn't is where the bug surfaces.
In 2024, DigiCert found an underscore missing from a validation step and had to revoke 83,000 certificates in 24 hours. One customer went to court to stop it. The real story isn't the typo.
Firefox 137 turned on CRLite for every user: the whole web's certificate revocations, a few megabytes checked locally with no lookup. The trick that makes a probabilistic filter exact.
For nearly two years, every key generated with OpenSSL on Debian and Ubuntu could be picked from a list of 32,767 — because a cleanup meant to silence a memory-checker warning deleted the line that stirred in the randomness.
In 2014 a missing bounds check in OpenSSL let anyone ask a server for 64KB of its own memory — private keys, passwords, session cookies — and the request looked exactly like a normal heartbeat, so no server could tell whether it had been robbed.
In 1998 Bleichenbacher broke RSA in TLS. The fix was a fragile workaround — so in 2017 it broke again, on 27 of the top 100 domains.
In 2012 an espionage toolkit pushed itself onto machines as a signed Windows Update. To sign it, the operators forged a Microsoft certificate with an MD5 collision no academic had published yet — the last link in a chain of institutional mistakes that all had to line up.
In 2014 a Google team broke SSL 3.0 — a protocol from 1996 that nobody chose anymore. POODLE didn't attack the crypto in use. It attacked the polite reflex that let a browser fall back to crypto from eighteen years earlier.
Before TLS encrypts anything, your client announces exactly what it is. The particular way it says hello is a fingerprint — and the story of JA3 and JA4 is the story of how identity leaks from the parts of a protocol nobody thought to hide.
In the 1990s the US government made companies ship deliberately breakable encryption abroad. The weak ciphers outlived the law by fifteen years — and in 2015, FREAK and Logjam switched them back on across a third of the web.