Security
Content Security Policy: make script trust explicit
Learn how CSP nonces, script hashes and report-only deployment work, why static sites need different choices, and where a browser policy cannot replace secure code.
Security.
Privacy, authentication and a more resilient digital world.
5 articles on this page
Security
OAuth PKCE: why an authorization code is not enough
Follow the verifier-and-challenge mechanism that binds an OAuth code exchange to the client that started it—and understand its limits.
Security
Zero trust starts with the resource—not the office network
Explore NIST’s zero-trust model, separate identity from permission, and understand why network location alone should not establish trust.
Security
TLS 1.3: what HTTPS protects—and what it does not
Understand authentication, confidentiality and integrity in TLS 1.3, then separate a protected connection from a trustworthy website.
Security
Passkeys, without the mystery
A practical look at the key pair behind passkey sign-ins, where the private key stays, and why account recovery still deserves your attention.
Your reading list is empty on this page. Bookmark a story to revisit it later.
YOUR NEXT GOOD READLess noise.
Less noise.
More perspective.
A considered collection of technology stories. Explore the latest, or take your curiosity somewhere new.