security basics
18 articles with this tag
What is public-key cryptography — encrypting and signing with a key pair
Public-key crypto uses a 'public key' (safe to hand out) and a 'private key' (held only by the owner). Anything encrypted with the public key can only be decrypted by the matching private key, and a signature made with the private key can be verified with the public key. That asymmetry underpins TLS (HTTPS) key exchange, digital signatures, and passkeys. Defenses: don't roll your own crypto (use standard protocols and battle-tested libraries), protect and be able to revoke the private key, and keep key length and algorithms current.
What is the OWASP Top 10 — the standard list of the 10 biggest web-app risks
The OWASP Top 10 is a list the non-profit OWASP publishes every few years of the 'most critical web-app risks.' It's a common language for developers and operators. The current edition (2021) is led by Broken Access Control, followed by injection, misconfiguration, vulnerable and outdated components, authentication failures, and more. These are risk CATEGORIES, not individual exploits — use them as a lens to audit your own app.
What is GDPR — the EU's data-protection rules and breach-notification duty
GDPR (General Data Protection Regulation) is the EU's comprehensive rulebook for protecting the personal data of people in the EU — and it can reach businesses outside the EU that serve EU users. It requires a lawful basis (e.g. consent), clear purpose, data minimization, data-subject rights (access/erasure), and breach notification to the authority (generally within 72 hours), with heavy fines for serious violations. The technical gist: collect and hold only the personal data you need, protect it, and be able to detect and report a breach quickly.
Added a login and called it secure? — authentication vs authorization
Authentication = verifying who someone is; authorization = deciding what they may do. They're different, and adding a login is not authorization. Without owner (user_id) scoping on data, 'logged in = sees all data' — the top-ranked OWASP Broken Access Control. Add an open registration scaffold and a stranger can sign up and walk in. Defenses: scope every query to the owner, close unneeded registration, defense-in-depth, audit/access logs before an incident, detect new sign-ups.
How do people store passwords? What the data shows — and the safe way
Representative surveys show ~54% rely on memory, ~33% write passwords on paper, and only ~36% use a dedicated password manager — with ~25% reusing passwords. Meanwhile Verizon's DBIR found credential compromise involved in ~38% of breaches and that ~74% of passwords in breach data were reused. In short: the popular storage habits are exactly what attackers exploit. The safe foundation is a manager (unique password per site) plus passkeys/MFA on your key accounts.
Security for the AI era: the basics to lock down now (priority checklist)
AI mostly amplifies attacks on EXISTING weaknesses (unpatched CVEs, reused passwords, exposed secrets) rather than inventing new ones — found automatically, fast, at scale. So the best preparation is locking down the basics in the right order: CVE patching + dependency monitoring, kill reuse + MFA, remove exposed secrets, least privilege, shrink the public surface, logs/IOCs, backups.
What works (and what doesn't) for AI-era security — why small sites get hit too
Four AI-era myths corrected: (1) too small to be targeted → automation removes 'a human picks you'; (2) needs a special new control → the basics still win; (3) a product makes you safe → prevention design before detection; (4) AI code is fast so it's safe → it ships with vulns, review before publishing. What works is the boring basics in the right order.
Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak
MFA is a second lock so a leaked password alone can't get you in — but what you turn on changes its strength by three tiers. SMS/email codes fall to relay phishing and SIM-swap; authenticator apps (TOTP) are mid; passkeys/security keys (FIDO2) can't be presented to a fake site at all — that's phishing resistance. Top priority: put phishing-resistant MFA on the keys to the kingdom (email, domain, payments). Storing recovery codes and having a backup factor complete the setup.
Backup essentials: the 3-2-1 rule and a recovery plan that survives ransomware
'I have a backup' isn't enough — only a backup you've verified you can restore is real. The basics: the 3-2-1 rule (three copies, two media types, one offsite). For ransomware you also need at least one 'offline or immutable' copy — an always-connected backup gets encrypted along with the original. Cloud sync is not a backup (it replicates deletions and encryption too). Versioning and a periodic restore test complete the practice.
Still on Windows 10? The security risks of running it after end of support
Windows 10 hit end of support on October 14, 2025. The core risk of staying is that newly found holes are never patched (forever-days) and pile up, making the machine a favored target. Consumer ESU is a one-year, security-only stopgap through October 13, 2026 (free enrollment routes exist, but the EEA free first year doesn't apply to most regions). The real fix is moving to Windows 11 or replacing the hardware — use ESU only as a bridge until that migration is done.
Securing a laptop you carry around — protecting against theft, loss, and shoulder-surfing
Carrying a laptop assumes you'll lose it or it'll be stolen. The real defense is designed so a loss doesn't leak the contents: disk encryption (BitLocker/FileVault), a strong login with a short auto-lock, and remote wipe/locate. With HTTPS everywhere, public-Wi-Fi sniffing is lower priority; the real threats are rogue APs, shoulder-surfing, and walking away. Don't over-trust a VPN — harden the device first.
Are password managers safe? How they work, cloud vs local, and how to choose
A password manager is safer than reuse or plaintext storage. The key is zero-knowledge encryption: your master password decrypts the vault only on your device, the provider holds only ciphertext, so a provider breach doesn't expose your passwords. The real single point is your master password plus vault MFA. Choose cloud (Bitwarden/1Password) or local (KeePass) by use.
The dangers of public Wi-Fi — the real risk isn't 'sniffing,' it's evil twins and ignored cert warnings
Public-Wi-Fi 'sniffing' is mostly mitigated by HTTPS and is lower priority now. The real risks are (1) connecting to an evil-twin fake AP yourself, (2) ignoring certificate warnings, and (3) exposing your device on the shared network. The strongest fix is surprisingly simple — use your phone's tethering, trust HTTPS and cert warnings, and don't auto-join unknown SSIDs. A VPN is the next layer.
The security baseline for indie devs and small operators: the whole standard set
The baseline isn't 'all equally important.' This site's priority order: 1) keys to the kingdom (MFA, domain, email), 2) secrets and code, 3) the app itself, 4) patch, detect, recover. With finite time, fill it top-down. Most serious breaches come not from novel attacks but from a gap in this foundation.
The security baseline for mid-to-large organizations: the standard foundation for teams
At scale the baseline shifts from a 'checklist' to 'programs with owners.' The priority order matches the indie version: 1) identity, 2) secrets and supply chain, 3) app and infra, 4) detect and respond, plus a cross-cutting people-and-governance layer. The big change: the leading cause of breaches moves from slips to people, process, departed-employee access, and third parties.
Security inventory — 7 checks people running several servers overlook
For solo/small operators, incidents come less from missing controls than from untracked state. The boundary is the PC holding your keys. Tier 2FA by root of trust, matrix your SSH keys to kill duplicates/unused/orphans, remove plaintext passwords from the cloud, remediate reversibly one at a time, and keep secrets out of the ledger. Inventory before adding tools.
Smartphone security basics — protecting the device that holds your keys, vault, and ID in one
A phone concentrates 2FA, email, banking, and ID into one single point of failure. The real defense isn't a security app: (1) a strong lock + short auto-lock (the passcode is the encryption key); (2) automatic OS/app updates; (3) official store + permission review; (4) set up remote lock/wipe in advance; (5) keep a backup of your 2FA. iOS/Android already encrypt and sandbox by default.
Is storing your passwords in Google Drive safe? How to keep them properly
Keeping passwords in a plaintext Google Doc/Sheet is dangerous: one Google account becomes the single point of failure for every password — account takeover, a rogue connected app, or phishing leaks them all at once. The fix is a dedicated password manager (contents stay encrypted even when synced). If you must use Drive, store only an encrypted vault file and put phishing-resistant MFA on the account.