Skip to content
Security Basics
-
Security Basics
Timing Attacks and Constant-Time Compare, Measured
Security lecture 6: == vs hash_equals and compare_digest timed by matching prefix, in-process and over loopback HTTP, plus a login that leaks which users exist.
-
Security Basics
AES-GCM Done Right: Nonces, Tags and Key Derivation
Security lecture 5: ECB leaking a picture, a reused GCM nonce exposing a message, a 1-byte tag PHP accepted, openssl enc traps and KDF costs, all run locally.
-
Security Basics
Hashing vs Encryption vs Encoding, Run and Measured
Security lecture 1: decode Base64 in one line, hash your text with SHA-256, flip one bit to see 128 bits change, and measure why MD5 fails for passwords.
-
Security Basics
Secure Random Tokens: random vs secrets, Measured
We rebuilt Python's random from 624 outputs and predicted the next session tokens, then measured secrets, random_bytes, UUIDv4 and time-seeded tokens.
-
Security Basics
Password Hashing with bcrypt and Argon2id, Measured
Security lecture 2: crack an unsalted hash with a 20-word list, time bcrypt, Argon2id, scrypt and PBKDF2 per guess, and hit bcrypt's 72-byte limit.
-
Security Basics
JWT HS256 by Hand: alg none, Weak Secrets, exp/aud
Build and verify an HS256 JWT with Python's stdlib, forge an alg none token against a naive verifier, crack a weak secret in 0.05 ms, then fix all three.
↑