Published Nov 16, 2023
Discover our new adversary model for cyber defense, focusing on one key aspect: adversary capability levels – from amateurs to government-backed APTs. It might be the only one you would ever need! Stay tuned for application examples.
Published Nov 2, 2023
Frustratingly, the security pop culture keeps ignoring the elephant in the room — the elephant academic researchers are pretty well aware of. Namely: there is no such thing as a password you can blame and sacrifice for the user’s sins. Not anymore. And whatever exists, it is not something with consistent security properties, not on the web at least.
Published Sep 18, 2023
A gazillion of trainings is out there, but the ugly truth is simple: since bulk email senders as a service took over, you can not. You can if it is really stupid, but if it is smart, no chance. Legitimate emails are just as suspicious now
Published Aug 7, 2023
Use the “latest” tag whenever possible. It may be extreme, depending on the software nature; if it is “too dynamic” and tends to break the backward compatibility, you can pin major or even minor versions but definitely not the exact build or worse, the image hash.
Published Nov 15, 2022
It is indisputable that the Google Glass failure was a devastating blow to smart glass tech. We have a radioactive wasteland poisoned for 10+ years, and who knows when it will be declared safe. “Even Google failed there, there is probably zero demand until we can take it to the next level!” But what actually happened?
Published Oct 10, 2022
I am a big fan of webauthn. It is the best thing that has happened to user authentication since OpenID (the "social network login" button we all love). But as always, the devil is in the details. Apple introduced a controversial "improvement" to webauthn called Passkeys, which could impair the security of your most valuable online resources.
Published Sep 9, 2022
Published Jun 15, 2018
The threat model for cryptocurrency exchange is somewhat unique even for finance applications; two essential techniques that make anti-fraud efforts fruitful in traditional fintech, are KYC and the capability to dispute a suspicious operation. In the cryptocurrency exchange, these may turn totally non-reliable or even nonexistent since crypto currency operations are generally anonymous and non-reversible. Thus, we need more rigorous (and preventive) security as compared to traditional banks and payment systems1. The traditional instruments we typically have at hand are obviously insufficient. We do not discard KYC completely, and we try to work around non-reversibility wherever possible. However, the purpose of this paper is to explore ways to surpass the intrinsic limitations of traditional methods, because the opposite approach of making case by case improvements is already getting enough public attention. A mindless combination of different authentication and recovery methods may merge into a cascade of failuresI instead of increasing redundancy and reliability; thus we need a systemic approach.