Everything I Learned Shipping Device Bound Session Credentials 🔗
We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the [...]
Scott Helme
Posts
Connection Allowlist: a network firewall, built into the browser 🔗
Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open [...]
Top 1 Million Analysis – June 2026: The State of Crypto 🔗
This is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookie [...]
Top 1 Million Analysis – June 2026: Ten Years of Web Security 🔗
It's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. B [...]
A dead CDN, a wildcard, and an attack waiting to happen: the netdna-ssl.com takeover 🔗
Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really [...]
Why No Passkeys? Naming the Top Sites That Still Don't Support Them 🔗
Back in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check wh [...]
The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students 🔗
A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a [...]
Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP 🔗
We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into [...]
DBSC Beta at Report URI 🔗
This week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers [...]
Device Bound Session Credentials: Making Stolen Cookies Useless 🔗
A stolen session cookie can be vastly more powerful than a stolen password. The attacker doesn’t need to phish the user, bypass MFA, or defeat their p [...]
Passkeys, Permissions Policy and Bug Hunting in 1Password's WebAuthn Wrapper 🔗
Passkeys are the best thing to happen to web authentication in years, but a passkey ceremony is only as secure as the stack enforcing it. The browser, [...]
Open-Sourcing passkeys-php: A Security-Focused WebAuthn Library for PHP 🔗
We've open-sourced passkeys-php, the WebAuthn server library we use at Report URI to protect logins with passkeys, security keys, and platform authent [...]
XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None 🔗
A single XSS vulnerability can turn passkeys from a phishing-resistant login mechanism into a persistent account takeover backdoor. If malicious JavaS [...]
Passkeys 101: An Introduction to Passkeys and How They Work 🔗
Passwords have been the weak point in online authentication for decades. They can be reused, guessed, stolen, phished, leaked, sprayed, stuffed, and c [...]
Anatomy of a WooCommerce Skimmer: A Technical Deep-Dive 🔗
One malicious change to a trusted JavaScript file can turn your checkout page into a silent credit-card skimmer, siphoning customer data off to crimin [...]