Author image


150 posts
Researcher, blogger and international speaker. I'm the creator of and, free tools to help improve online security.

Certificate Transparency, an introduction

Certificate Transparency is an open framework for monitoring and auditing the certificates issued by Certificate Authorities in near real-time. By requiring a CA to log all certificates they generate, site owners can quickly identify mis-issued certificates and it becomes much easier to detect a rogue CA. Certificate Transparency The CT…

Continue Reading

Cross-Site Request Forgery is dead!

After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution. No technical burden on the site owner, no difficult implementation, it's trivially simple to deploy, it's Same-Site Cookies. As old as the Web itself Cross-Site Request Forgery, also known as CSRF…

Continue Reading

OCSP Expect-Staple

OCSP Expect-Staple is a new reporting mechanism to allow site owners to monitor how reliable their OCSP Stapling implementation is. With live feedback coming direct from the browser, you can build confidence before enforcing OCSP stapling with OCSP Must-Staple. Fixing revocation I don't need to talk about how broken revocation…

Continue Reading