Passkeys Are Not a Trap 🔗
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've h [...]
Scott Helme
Posts
The First Reduction in Their History: 64-Day Let's Encrypt Certificates 🔗
I remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web". [...]
No Hacking Required: The Manchester Airports Group Data Breach 🔗
On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookin [...]
The ultimate road trip combo: Starlink Mini + UniFi Travel Router 🔗
I recently went on an epic road trip around Europe, covering 1,645 miles (2,647 km), and we took in some amazing sights and locations. As a tech geek, [...]
Introducing dbsc.dev: Does Your Browser Support DBSC? 🔗
Every other web platform feature I've ever written about, I've been able to test in some easy way. Open DevTools, type the name of the thing, see if i [...]
Device Bound Session Credentials lands in Chrome on macOS 🔗
Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer [...]
Everything I Learned Shipping Device Bound Session Credentials 🔗
We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the [...]
Connection Allowlist: a network firewall, built into the browser 🔗
Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open [...]
Top 1 Million Analysis – June 2026: The State of Crypto 🔗
This is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookie [...]
Top 1 Million Analysis – June 2026: Ten Years of Web Security 🔗
It's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. B [...]
A dead CDN, a wildcard, and an attack waiting to happen: the netdna-ssl.com takeover 🔗
Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really [...]
Why No Passkeys? Naming the Top Sites That Still Don't Support Them 🔗
Back in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check wh [...]
The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students 🔗
A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a [...]
Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP 🔗
We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into [...]
DBSC Beta at Report URI 🔗
This week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers [...]