Scott Helme

One of eMudhra's certificate authority private keys is the number 4.

A post called Passkeys are a trap.

I remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web".

On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data.

I recently went on an epic road trip around Europe, covering 1,645 miles (2,647 km), and we took in some amazing sights and locations.

Every other web platform feature I've ever written about, I've been able to test in some easy way.

Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware.

We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn't prepare you for.

Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open network connections to.

This is part two of the ten-year anniversary Top 1 Million Analysis.

It's been a long time since the last one of these!

Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really shouldn't.

Back in 2017, Troy Hunt and I built a little website called whynohttps.com.

A single support ticket became the front door to 275 million student records.

We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful.

This week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers and reduce the damage caused by stolen cookies.

A stolen session cookie can be vastly more powerful than a stolen password.

Passkeys are the best thing to happen to web authentication in years, but a passkey ceremony is only as secure as the stack enforcing it.