NEW: The U.S. Congressional Budget Office was hacked. @doublepulsar.com found that the cause may be an unpatched Cisco ASA firewall. I asked CBO about that but it did not respond to the question. techcrunch.com/2025/11/07/c...

I hired a director recently and this was my screening question: can you please explain the difference between public-key and symmetric-key cryptography. Virtually all the candidates, who universally claimed security engineering expertise of some kind (some cryptography-related) could not. At all.

AI can lift human dignity by opening doors to more people and adapting to how we think, letting us focus on what matters. But only if we design it right and keep monitoring its work. 👇

Researchers pointed a satellite dish at the sky for 3 years and monitored what unencrypted data it picked up. The results were shocking: They obtained thousands of T-Mobile users' phone calls and texts, military and law enforcement secrets, much more: www.wired.com/story/satell... 🧵👇

This morning, a serious WebPKI incident surfaced: a tiny CA misissued certificates for 1.1.1.1 - Cloudflare’s DNS service. With BGP hijacks happening regularly, those certs could enable full man-in-the-middle attacks. 👇

Looks like something is up in Whoville. It seems an obscure CA trusted by Microsoft has issued a certificate for 1.1.1.1. groups.google.com/a/mozilla.or...

Prof. Michael Specter on practical vulnerabilities in deployed mobile voting systems. www.youtube.com/watch?v=_BgA... #VotingVillage

Big milestone for email security. CA/Browser Forum just published S/MIME BR v1.0.11. Now with NIST-approved post-quantum algorithms (ML-DSA & ML-KEM). Quantum-resistant S/MIME is here. 👇

Building on the great research by Cem Paya and Matthew Ludwigs at River Financial, my new post details how attackers are exploiting fundamental assumptions in Microsoft's code signing. 👇

With Authenticode & CA/B Forum–compliant code signing, intent ≠ immunity. The Baseline Requirements define revocation conditions based on use in the wild, not the developer’s intent. Ship signed code? Design it to resist abuse — attackers can weaponize your trust, and your cert can be pulled.

The "Invitation Is All You Need" attack: AI agent poisoned through calendar, executed malicious commands days later. AI agents persist memory across sessions, and static credentials become persistent threats. 👇

One of the best parts of Black Hat is the hallway track. This week, I got to watch some great talks with friends, and one reminded me of a common pattern, the innovation–security debt cycle: 1️⃣ Rush to ship 2️⃣ Debt builds 3️⃣ Incident forces change 4️⃣ Security becomes a differentiator 👇

In the 1960s: "Don't have kids, the world will starve." Today: "Don't learn to code, AI will do it all." Both predictions ignore the same truth, when there's money to be made, markets adapt faster than doomsday forecasters expect. 👇

We build systems to make things easier. But too often, what we call “automation” ends up feeling like digital red tape, frustrating, rigid, and impossible to reason with. 👇

From dropping tables to jailbreaking GPTs, some kids just never change. Meet Little Bobby Prompts. 😂

The biggest digital identity experiment in U.S. history wasn’t planned; it was a side effect of pandemic-era fraud. Now that Apple and Google are standardizing digital ID in wallets, we’re about to find out if market pressure can succeed where government urgency failed. 👇

As a recovering security engineer, I recognize threat modeling anywhere. Lawyers do it constantly - they're security engineers for text. So why does legal AI treat them like secretaries? 👇

450,000+ certificates are issued every hour across the WebPKI. But raw volume doesn't tell you which CAs actually matter. Matthew McPherrin recently shared Mozilla's Firefox telemetry data showing actual CA usage vs the Certificate Transparency issuance numbers I usually track. 👇

For decades, companies shipped their structure. Now a solo founder with AI agents for product, marketing, development and support can move faster than entire teams. No org chart means no internal drag. 👇

A WebTrust seal is often marketed by CAs as a gold star, but in reality, it simply confirms they’ve met the minimum bar. The accounting style audit model was never designed to surface hidden security gaps, and its incentives can even reward looking the other way. 👇

Classic moral hazard problem in internet infrastructure: Those making critical security decisions don't face the consequences when things go wrong. Meanwhile, 8 billion users bear all the risks. This misalignment creates predictable problems across any system at scale. 👇

The future of web trust isn't weaker enforcement. It's making the CPS the living, automated center of CA operations. Policy must drive practice, not just scramble to document it. The security of 8 billion people depends on it. #WebPKI groups.google.com/a/mozilla.or...

My kids are going to grow up thinking “Shit My Dad Says” was mostly just t-shirts about cryptography, root access, malware, and accountability in Git. And… they’ll be right.

Mozilla recently hosted a roundtable with CAs and ecosystem stakeholders to discuss improving Web PKI practices. One surprising takeaway? Some participants argued for less accountability when a CA’s documented promises don’t match what they actually do. That’s the wrong direction. 👇

We need a "slow computing" movement, the digital equivalent of "slow food". We need to code better, with human care and attention to details, with true understanding of technology, achieving better performance with fewer resources. We can do more with less if we believe in it.

It's fascinating to see AI agents learning to navigate the web as we do. But will browsing truly be their main method of interaction long-term? 👇

Excellent post on how confidential computing is being used with the transparency.dev witness ecosystem. blog.transparency.dev/hardening-wi...

Most key management tools were built for machines. That’s why so many key management failures happen when people use keys. We built Goodkey for a different reality— where humans and agents both need secure, effortless crypto. Signing, encryption, and authentication. No crypto PhD required.

Thirty years ago, Sneakers gave us a fictional black box that could break every code. Today, quantum computing is bringing that concept dangerously close to reality. I wrote about what Sneakers got right and what it can teach us about the coming quantum computing future. 👇

Did a panel on crypto agility this week that touched on crypto agility, so I put down some thoughts on the topic. Short answer? It’s not a checkbox but an operational mindset. 👇

In ’89, I installed the latest CompuServe client, dialed in at 2400 baud, and saw pure magic: a GIF loading progressively. Line by line, pixel by pixel. Sounds quaint now—but back then, it felt like watching the future arrive in slow motion.

Is AI the key to unlocking the multi-cloud promise, or is it accelerating commoditization? unmitigatedrisk.com?p=1009

Ever nodded along in meetings about TPMs, TEEs, HSMs, or "Confidential Computing" without fully getting them? I wrote this to clear things up: "From TPMs to TEEs: How Security Technologies Work—and Where They Fail" 👉 unmitigatedrisk.com?p=991

I love this idea. Operating systems usually rely on the user as the main abstraction for isolation, but in modern systems, code itself needs its own isolation and communication primitives. www.theregister.com/AMP/2025/03/...

Operations evolved from hands-on sysadmins in the '60s to DevOps and SREs managing thousands of systems. Now, Al-native operations will redefine infrastructure at massive scale. Are we ready for this shift? Read more: https:// unmitigatedrisk.com/?p=984

Great post on how to distrust a CA without any certificate errors from @dadrian.io

It’s the time of year where we re-read ComodoHacker’s pastebin. Props to pastebin.com for keeping this up for all these years. pastebin.com/u/ComodoHacker

WebPKI incidents prove preparation and transparency matter. My post on turning crises into resilience, with WebPKI lessons for context. Interested?

Former CISA director Jen Easterly helped put together a site that matches laid-off CISA employees with companies that want to hire them. bit.ly/4bxFqAF

Wow, 239 experts and organizations say no backdoors in the UK: "Joint Letter on the UK Government's use of Investigatory Powers Act to attack End-to-End Encryption" Global Encryption Coalition

DigiCert’s Legal Threats Aim to Silence Discussion in the WebPKI Community. bugzilla.mozilla.org/show_bug.cgi...

Having seen firsthand how long-standing practices in the WebPKI can burden us, I’m convinced that shifting from 398 days to even shorter lifetimes is a necessary evolution. unmitigatedrisk.com?p=974

#SaltTyphoon gained initial access to Cisco devices as part of the Chinese nation-state threat group’s sweeping attacks on U.S. telecom networks, the company confirmed Thursday in a #threat intelligence report. via @mattkapko.com cyberscoop.com/cisco-talos-...

New in Chrome DevTools: Accurately emulate CPU performance of a low/mid tier phone with Automatic CPU throttling calibration! 📲 This feature calculates slow-downs for your specific device. Wanted this for years! We just shipped it.

It works! Beyond passkeys, I can encrypt a file in the browser with typage and WebAuthn, and then decrypt it with the same YubiKey from the CLI with age-plugin-fido2prf. README: github.com/FiloSottile/ty… PR: github.com/FiloSottile/ty…

Let's Encrypt has issued its first 6-day certificate! letsencrypt.org/2025/02/20/f...

An easter egg in the latest Ctrl-Alt-Speech podcast: Mike Masnick announced a new podcast that walks through the history of Section 230. Yay! To whet your whistles, we released a regulatory encyclopedia/scalpel for global intermediary liability online:

We've got killer talks in the hopper for Enigma 2025 track at USENIX Security this year in Seattle! Deadline is 5 March and we'd love to have YOU up there on the dais sharing your cutting edge security knowledge

my new blog post: ML-KLEM and ML-DSA Post-Quantum Cryptography in .NET 🔗 www.strathweb.com/2025/02/ml-k...