Scott Brady - scottbrady.io

A review of the changes in 2025 and my plans for 2026.

A review of the changes in 2024 and my plans for 2025.

A modern overview of the WS-Federation protocol, focussing on the parts of the protocol that are still in use and somewhat useful to know.

A review of the changes in 2023 and my plans for 2024.

An overview of the book “An Elegant Puzzle: Systems of Engineering Management” by Will Larson, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.

How to create your own RSA key in .NET or load one from a JSON Web Key, a PEM file, or an X.509 certificate.

Implementing AES with ECB and CBC block cipher modes and brute-force decrypting your first encryption oracle.

A review of the changes in 2022 and my plans for 2023.

An overview of the book “The Making of a Manager: What to Do When Everyone Looks to You” by Julie Zhou, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.

Learn the pros and cons of each OAuth client authentication mechanism and take your OAuth security beyond client secrets.

An overview of the book 'The Art of Leadership' by Michael Lopp, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.

Learn how to create and validate JSON Web Tokens (JWTs) in Python using the Authlib library, JWT security best practices, and claims validation.

Learn how JSON Web Encryption (JWE) works with a walkthrough of the token format, best practices, and the encryption algorithms available to you.

Learn how to use JWTs securely with my latest course on Pluralsight: JWT Fundamentals.

Learn how the UK's Open Banking makes use of OAuth and OpenID Connect.

Learn how to implement and trigger standards-based step-up authentication using OAuth, OpenID Connect, and SAML.

A review of the changes in 2021 and my plans for 2022.

How to log into an Umbraco website as an end-user via an external SSO solution such as IdentityServer, Google, or Auth0.

Why I have left Rock Solid Knowledge, what I’m doing in my new job at 10x Banking, and what, if anything, will change on this website.

A deep dive into OpenID Connect’s ID token, looking at what identity tokens are, what they are not, where to use them, and how to validate them.

How to log into the Umbraco backoffice using an external identity provider such as IdentityServer, Azure AD, or Auth0.

Polywork is a new social media platform that I’ve been using to track my recent achievements, both big and small, and to tackle my ongoing impostor syndrome.

Drag your XML signing into the 2020's with modern cryptography by signing XML with ECDSA.

How to sign XML in .NET and .NET Core using an RSA key while avoiding common XML security pitfalls.

Four different ways of loading Elliptic Curve (EC) keys in .NET for use with Elliptic Curve Digital Signature Algorithms (ECDSA).

I’m an Umbraco MVP for 2021!

Learn how OAuth Proof-Key for Code Exchange (PKCE) does not replace client authentication (e.g. secrets) and why you should use both where possible.

Learn how to use AES-GCM encryption in .NET for authenticated encryption, giving you the usual confidentiality and an additional integrity check.

Learn how password shucking attacks rehashed or pre-hashed passwords by stripping your password hashes of their strong outer password hashing algorithm.

Learn how to automatically set HTML passwordrules based on your ASP.NET Identity password options, using the newpassword tag helper from ScottBrady.IdentityModel.

Learn how to integrate sign up forms with password generators by using the autocomplete and passwordrules HTML attributes.

SAML is the protocol that no one wants to use.

A review of what little I got up to in 2020 and my plans for 2021.

Avoid a common OAuth pitfall by learning how OAuth consent and access tokens differ from user-level authorization policies.

Learn the introductory theory behind XChaCha20-Poly1305, a standby cipher for symmetric encryption, and how to use it in .NET with libsodium or implement it yourself by 'rolling your own crypto' on top of Bouncy Castle.

Learn how to load keys and certificates from PEM files in .NET.

My talk from NDC Oslo 2020.

Learn the difference between each JOSE algorithm (e.g.

An OpenSSL cheat sheet for creating RSA private keys, public keys, and certificates for use with RSASSA-PKCS1-v1_5 and RSASSA-PSS.

My experience and highlights from the OAuth Security Workshop 2020.

How to use ES256 to sign JWTs in IdentityServer4 while still supporting RS256 for backward compatibility.

An OpenSSL cheat sheet for creating EC private keys, public keys, and certificates for use with ECDSA.

How to use Tailwind CSS and Bootstrap 4 side-by-side.

Physical biometrics, such as fingerprint or facial recognition, are super useful when logging into mobile apps.

A primer on EdDSA and how to use it for JWT signing in .NET Core using Bouncy Castle and ScottBrady.IdentityModel.

Branca, PASETO, XChaCha20-Poly1305, and Base62 support in .NET Core using ScottBrady.IdentityModel.

JWTs get a lot of hate from the crypto community, but what are the alternatives?

How to outsource IdentityServer4 JWT signing to Azure Key Vault.

My experience with OpenSK, an open-source FIDO2 authenticator implementation, using a VirtualBox VM and FIDO2 for ASP.NET.

New features in IdentityManager2 with ASP.NET Core 3.1 and SameSite cookie support.