OAuth - Why it doesn't work, and how to Zero-day attack existing services

Since this article is extremely long, it is also available in a PDF version . This article also has a companion website .  Intro What is OAu...

Protecting private keys

Web servers use private keys which they alone have in order to secure connections with users. Private keys must be protected at all costs. ...

HTTP 308 Incompetence Expected

Internet History The Internet from every angle has always been a house of cards held together with defective duct tape. It's a miracle t...