Aaron Parecki

#Security

• 

  Massive PHP CVE drops tomorrow.
  
  This is what deferred maintenance looks like. This is why I've been working through the backlog of my projects. I've been either using Claude to upgrade them to a modern PHP version, or archiving them as static HTML.
  
  Claude was also able to put this report together for me in about 5 minutes. Now I just have to triage, and yes there will be some hard decisions to make.

  

  San Francisco, California, USA • 62°F

  5 likes 3 reposts 2 replies

  Tue, Oct 20, 2026 10:15pm -07:00 #php #security
• Hacking SAML with Claude Code | Oblique (oblique.security)

  Fri, Aug 21, 2026 6:44am -07:00 #saml #security
• 

  I'm setting up a temporary laptop for my next trip and it's shocking how much faster the cross-device passkey flow is compared to looking up and hand typing my long 1Password passwords

  Portland, Oregon • 46°F

  13 likes 1 repost 2 replies

  Thu, Mar 5, 2026 7:26pm -08:00 #security #passkey
• BBS Botnet - The Packet Radio Cybersecurity Crisis in Ham Radio - TheModernHam (themodernham.com)

  Wed, Nov 19, 2025 10:28am -08:00 #hamradio #security
• Frequent reauth doesn't make you more secure (tailscale.com)

  Thu, Jun 12, 2025 3:04pm -07:00 #security
• Passkeys for Normal People (www.troyhunt.com)

  Wed, May 7, 2025 7:15pm -07:00 #passkeys #security
• 

  Chase sends 8-digit 2fa SMS codes, which seems excessive compared to the 6 that most other places use, but even weirder is that the first digit of them has always been the same, effectively making it a 7 digit code. Anyone know what's up with that?

  Portland, Oregon, USA • 41°F

  4 likes 7 replies

  Sat, Feb 15, 2025 5:56pm -08:00 #security #sms #2fa
• 

  At long last, the OAuth working group has finished the Best Current Practice for OAuth 2.0 Security and it was just published as RFC9700! This has been a long time in the works, and I'm very thankful to everyone who has helped out with it over the years!
  
  https://www.rfc-editor.org/rfc/rfc9700.html
  
  This is one of the major inputs to OAuth 2.1, so I'm also very excited to be able to move that forward this year as well!

  Portland, Oregon • 37°F

  65 likes 36 reposts 3 replies

  Tue, Feb 4, 2025 11:15am -08:00 #ietf #oauth #rfc #security
• Millions of Accounts Vulnerable due to Google’s OAuth Flaw ◆ Truffle Security Co. (trufflesecurity.com)

  Tue, Jan 14, 2025 1:08pm -08:00 #oauth #security
• 

  Someone broke through the chain link fence last week, in broad daylight, while I was home, and didn't notice at the time.
  
  I started thinking about what I could do about it, and it turns out the EA Unifi cameras have a new webhook feature. So now my cameras send a webhook to Home Assistant when someone crosses a virtual line, and it will trigger the siren. Since this is a line crossing event, not generic person detection, I can leave it armed 24/7, since nobody should be in that area at all.

  Portland, Oregon, USA • 91°F

  10 likes 2 replies

  Thu, Aug 8, 2024 7:03pm -07:00 #homeautomation #security #homeassistant #unifi
• Google Online Security Blog: Improving the security of Chrome cookies on Windows (security.googleblog.com)

  Tue, Jul 30, 2024 2:08pm -07:00 #chrome #security #google

• OAuth in Native Apps - OAuth Security Workshop 2024

  Slides from my presentation at the OAuth Security Workshop in 2024

  continue reading...

  Thu, Apr 11, 2024 9:00am +02:00 #oauth #security #osw #osw2024
• Calendar Meeting Links Used to Spread Mac Malware – Krebs on Security (krebsonsecurity.com)

  Wed, Feb 28, 2024 11:34am -08:00 #security #malware
• How I Fell for an Amazon Scam Call and Handed Over $50,000 (www.thecut.com)

  Fri, Feb 16, 2024 3:51pm -08:00 #security #scam
• 

  Now that @1Password launched passkey support *and* it's integrated into iOS 17 with the 1Password app, I feel like I can finally actually take the plunge and set up passkeys everywhere!
  
  No more passwords! and the login UX is so much better too!

  Portland, Oregon, USA • 59°F

  32 likes 9 reposts 2 replies 1 mention

  Sat, Sep 23, 2023 6:48pm -07:00 #security #passkey #password
• HPKE: Standardizing public-key encryption (finally!) (blog.cloudflare.com)

  Wed, Aug 30, 2023 6:05pm -07:00 #encryption #security
• Device Bound Session Credentials explainer (github.com)

  Tue, Aug 29, 2023 3:50pm -07:00 #cookies #browsers #security #oauth
• MSEdgeExplainers/BindingContext/explainer.md at main · MicrosoftEdge/MSEdgeExplainers (github.com)

  Tue, Aug 29, 2023 3:49pm -07:00 #dpop #bpop #oauth #security #cookies #browsers
• London (LHR) to Portland (PDX)

  August 25, 2023 from 3:30pm (+0100) to 5:20pm (-0700)

  British Airways Flight 267

  

  Portland Intl in Portland

  permalink #oauth #security
• OAuth Security Workshop

  Aug

  22

  Aug

  23

  Aug

  24

  August 22-24, 2023
  3 days

  Royal Holloway

  Runnymede, England, GBR

  permalink #oauth #security #osw