David Adrian
@dadrian.io
📤 566
📥 96
📝 235
Used to do TLS, still kind of do TLS. PM at Chrome Security. Founded Censys.
@scwpod.bsky.social
reposted by
David Adrian
Deirdre Connolly¹ ²
12 days ago
new Merkle Tree Cert only Chrome Quantum Root Store:
security.googleblog.com/2026/02/cult...
loading . . .
Cultivating a robust and efficient quantum-safe HTTPS
Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against ...
https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html?m=1
0
8
4
reposted by
David Adrian
Thomas Ptacek
12 days ago
None of you are giving me enough credit for not participating on the TLS working group mailing list. You're welcome. Everything I don't do, I don't do it for you.
2
25
2
Who up losing they minds on this site?
22 days ago
1
1
0
reposted by
David Adrian
Security Cryptography Whatever
about 1 month ago
NEW EPISODE! The maintainers of py/cryptography declared that after many years of trying to make it work, they would be moving away from OpenSSL when supporting new functionality and exploring adding other backends:
securitycryptographywhatever.com/2026/02/01/p...
www.youtube.com/watch?v=dEKB...
loading . . .
Python Cryptography Breaks Up with OpenSSL with Paul Kehrer and Alex Gaynor
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=dEKBHI3rodY
5
19
7
Thinking about Curt Cignetti.
about 2 months ago
0
0
0
I cannot get over how impressive it is what Curt Cignetti accomplished at Indiana
about 2 months ago
0
1
0
Indiana shall light this holy ring, release its cleansing flame, and burn a path into the divine beyond!
add a skeleton here at some point
about 2 months ago
0
1
1
reposted by
David Adrian
rmhrisk
about 2 months ago
This is what zero-trust looks like at the infrastructure layer. Identity and encryption match the lifetime of the thing being secured. If your certificate strategy still assumes stable names and year-long validity, it is already behind reality.
letsencrypt.org/2026/01/15/6...
loading . . .
6-day and IP Address Certificates are Generally Available
Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscr...
https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability
0
3
1
reposted by
David Adrian
Deirdre Connolly¹ ²
about 2 months ago
dadrian.io/blog/posts/s...
loading . . .
Stop inventorying keys.
If you have a reason to migrate to post-quantum cryptography (PQC), you should not be inventorying keys for the purpose of migration, and you should stop listening to anyone who suggests that you do s...
https://dadrian.io/blog/posts/stop-inventorying-keys/#fnref:1
0
5
4
reposted by
David Adrian
Deirdre Connolly¹ ²
about 2 months ago
add a skeleton here at some point
0
10
5
repent! for the day of sixteen windiana shall be upon us!
2 months ago
0
2
1
reposted by
David Adrian
Thomas Ptacek
2 months ago
Final SCW of 2025! We had Matt Bernhard on to talk about cryptographic voting systems, in the wake of the IACR election. (Everybody I voted for in the new election won! Woo!)
add a skeleton here at some point
0
9
3
reposted by
David Adrian
Joseph Lorenzo Hall, PhD
2 months ago
What a fantastic present to end the year! (swear I woke up like this)
@mbernhard.com
@durumcrustulum.com
@sockpuppet.org
@dadrian.io
@scwpod.bsky.social
1
7
1
reposted by
David Adrian
Filippo Valsorda
4 months ago
This Bernstein crap drives me up the wall because IT MAKES NO SENSE. Why would the NSA be picking weak crypto to protect US NatSec?! They have mathematicians and clusters in China, too! Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM.
7
64
7
reposted by
David Adrian
Jeff Hodges
4 months ago
Wonderful news! The kind of thing a lot of software folks across the world have been working to make possible. So stoked the Chrome folks are pushing us forward
add a skeleton here at some point
0
5
1
reposted by
David Adrian
Andrew Whalley
4 months ago
It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption!
security.googleblog.com/2025/10/http...
loading . . .
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
https://security.googleblog.com/2025/10/https-by-default.html
3
91
33
One year from now, Chrome will enable "Always Use Secure Connections" and warn users before plaintext HTTP by default.
loading . . .
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
https://security.googleblog.com/2025/10/https-by-default.html
4 months ago
0
16
9
Iowa-Rutgers hitting the over? Trump ruined the B1G West.
6 months ago
0
0
0
New post! Stop trying to solve revocation, we already have the answer.
dadrian.io/blog/posts/r...
loading . . .
Revocation ain't no thang.
Adam Langley wrote about how revocation in the Web PKI doesn’t work over 10 years ago. Since then, the Web PKI has drastically changed for the better, despite not appearing to “solve” revocation. Unfo...
https://dadrian.io/blog/posts/revocation-aint-no-thang/
6 months ago
0
4
3
Kirk Herbstreit is going to be the first person to make a Golden Retriever unlikable.
6 months ago
0
1
1
reposted by
David Adrian
rmhrisk
6 months ago
The bigger issue? Microsoft’s root program still trusts this CA, leaving Edge and Windows users exposed in ways Chrome, Firefox, and Safari users aren’t. The pattern is familiar: long-lived trust, weak oversight, systemic risk. It’s time for Microsoft to step up and fund proper root governance. 👇
loading . . .
Another Sleeping Giant: Microsoft’s Root Program and the 1.1.1.1 Certificate Slip | UNMITIGATED RISK
https://unmitigatedrisk.com/?p=1092
2
3
1
If you look closely, you can see UNC’s quarterback is not Tom Brady
6 months ago
1
3
1
reposted by
David Adrian
Matt Bernhard
6 months ago
This game has me feeling like I'm watching Iowa play Iowa.
0
2
1
Sent this to a girl in California and pretty sure she thinks it’s in another language
add a skeleton here at some point
7 months ago
1
2
0
Come for the PGP dunks, stay for the broader discussion of why encrypted email doesn’t make sense
add a skeleton here at some point
7 months ago
1
13
8
reposted by
David Adrian
Simon Fondrie-Teitler
7 months ago
The first part of this interview with my ex-colleague Alex is a great listen if you're a software engineer (or otherwise technical) and are interested in what we were working on as technologists at the Federal Trade Commission.
add a skeleton here at some point
0
3
2
reposted by
David Adrian
Security Cryptography Whatever
7 months ago
NEW EPISODE! An OpenPGP.js bug gave us an excuse to tear encrypted email via PGP to shreds. William Woodruff joined us to explain the vuln & indulge our gnashing of teeth on why email was never meant to be encrypted:
securitycryptographywhatever.com/2025/08/22/s...
www.youtube.com/watch?v=IoL3...
loading . . .
Stop Using Encrypted Email with William Woodruff
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=IoL3LfIozJo
2
22
15
reposted by
David Adrian
Security Cryptography Whatever
7 months ago
NEW EPISODE! We chat with friend of the pod and special guest Alex Gaynor, former deputy chief technologist at the FTC and all around good Security Person™. Join for nerdery about WebAuthn, stay for accidentally melting down GitHub APIs around November 2020!
youtu.be/gBoGvyvsSi4
loading . . .
Alex Gaynor
YouTube video by Security Cryptography Whatever
https://youtu.be/gBoGvyvsSi4
0
4
3
And then there’s David.
add a skeleton here at some point
7 months ago
0
3
0
figma balls
7 months ago
0
1
0
reposted by
David Adrian
Security Cryptography Whatever
8 months ago
New episode! Come to SCWPodCon, sponsored by Teleport!
www.youtube.com/watch?v=tbnh...
loading . . .
Vegas, Baby!
YouTube video by Security Cryptography Whatever
https://www.youtube.com/watch?v=tbnhsmRZniI
1
0
3
reposted by
David Adrian
brandon
8 months ago
🫡 go blue
www.michigandaily.com/opinion/edit...
#a2council
loading . . .
From The Daily: Vote yes on Ann Arbor proposals A and B
This Editorial Board endorses these proposals and believes that the development of this new, multi-use structure would offer many new opportunities to the Ann Arbor District Library and the greater lo...
https://www.michigandaily.com/opinion/editorials/from-the-daily-vote-yes-on-ann-arbor-proposals-a-and-b/
1
29
5
reposted by
David Adrian
Deirdre Connolly¹ ²
8 months ago
pew pew pew
www.youtube.com/watch?v=vtt8...
loading . . .
This Quantum Attack Is Live Now
YouTube video by Deirdre Connolly
https://www.youtube.com/watch?v=vtt8js8uA78
0
8
4
Just posted a deep dive on how Chrome integrates with Advanced Protection Mode on Android.
security.googleblog.com/2025/07/adva...
loading . . .
Advancing Protection in Chrome on Android
Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team Android recently announced Advanced Protection , which extend...
https://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html
8 months ago
0
1
1
Wrote some words about memory safety and JITs. Basically, there are things we want out of hardware, but it's not MTE and it still involves migrating to memory safe languages
dadrian.io/blog/posts/m...
loading . . .
Sandboxes? In my process? It's more likely than you think.
Discussions around memory safety often focus on choice of language, and how the language can provide memory safety guarantees. Unfortunately, choosing a language is a decision made at the start of a p...
https://dadrian.io/blog/posts/memory-safety-and-sandboxes/
8 months ago
0
4
3
reposted by
David Adrian
Electronic Frontier Foundation
8 months ago
We’re not yet sure exactly what quantum computing can do yet, and that’s exactly why we need to think about post-quantum cryptography now,
@durumcrustulum.com
tells EFF’s Cindy Cohn and
@thejasonkelley.com
on the new episode of “How to Fix the Internet."
loading . . .
Podcast Episode: Cryptography Makes a Post-Quantum Leap
The cryptography that protects our privacy and security online relies on the fact that even the strongest computers will take essentially forever to do certain tasks, like factoring prime numbers and ...
https://www.eff.org/deeplinks/2025/06/podcast-episode-cryptography-makes-post-quantum-leap
2
42
10
Guide for
#a2council
to just do things— Step 1: Ask
@sstrudeau.bsky.social
and
@akgood.bsky.social
what rules to get rid of. Step 2. Get rid of those rules.
add a skeleton here at some point
9 months ago
0
7
0
If
#a2council
would have just done things, instead of wasting time with an expensive and useless comprehensive land use plan, then John U. Bacon wouldn’t be able to post boomer misinformation about it.
9 months ago
4
16
4
reposted by
David Adrian
Security Cryptography Whatever
9 months ago
Still have one more slot for a sponsor for our annual Vegas event, poke
@dadrian.io
if you have money.
0
1
2
There is literally a machine that does your laundry.
add a skeleton here at some point
9 months ago
3
8
3
reposted by
David Adrian
Ethan (not that Ethan)
9 months ago
More like Santa Ono! Disaster! What a bad idea!
add a skeleton here at some point
0
7
1
reposted by
David Adrian
Thomas Ptacek
10 months ago
Sophie Schmieg + ayahuasca =
keymaterial.net/2025/05/23/t...
loading . . .
There is no Diffie-Hellman but Elliptic Curve Diffie-Hellman
When I first learned about Diffie-Hellman and especially elliptic curve Diffie-Hellman, I had one rather obvious question: Why elliptic curves? Why use this strange group that seems rather arbitrar…
https://keymaterial.net/2025/05/23/there-is-no-diffie-hellman-but-elliptic-curve-diffie-hellman/
0
11
3
reposted by
David Adrian
Amy
10 months ago
Behold my favorite weird Chrome security bug of 2025 so far! A jaw-dropping URL / omnibox spoof via ligatures, specifically the googlelogo ligature.
issues.chromium.org/issues/39178...
loading . . .
Chromium
https://issues.chromium.org/issues/391788835
1
16
10
the signatures must flow.
10 months ago
1
1
0
If you have a legitimate reason to get a publicly-trusted HTTPS certificate for a .arpa domain, speak now or forever hold your peace.
10 months ago
1
5
4
reposted by
David Adrian
Deirdre Connolly¹ ²
10 months ago
if you like Google Advanced Protection Program and run Android, get excited for Android 16:
security.googleblog.com/2025/05/adva...
3
20
5
reposted by
David Adrian
Deirdre Connolly¹ ²
10 months ago
add a skeleton here at some point
2
4
1
reposted by
David Adrian
Hector Diaz
10 months ago
A Chicago Pope implies the existence of an MLA Pope and APA Pope
38
28789
8864
Ungovernable because none of your software works and you can't get anything done.
add a skeleton here at some point
10 months ago
1
3
1
reposted by
David Adrian
Filippo Valsorda
11 months ago
Why is the latest version of uBlock Origin Lite asking permission to access all websites now? I love uBO Lite precisely because it doesn't make me trust an extension developer with all my browser security... (Let's not re-debate MV3 unnecessarily please. Will block.)
3
26
4
Load more
feeds!
log in