How to Hash Passwords in 2026: Argon2id, bcrypt and the NIST Baseline
Argon2id, bcrypt, scrypt and PBKDF2 compared: memory-hardness, OWASP baselines, NIST 800-63B rules, and the perennial mistakes.
JWT Security: alg=none, Key Confusion and Why the Header Lies
The JWT vulnerability class explained: alg=none, RS256/HS256 key confusion, jwk and kid injection — and the RFC 8725 defenses.
DNSSEC Explained: Chain of Trust, NSEC3 and the October 2026 Root Rollover
How DNSSEC signs the DNS: RRSIG, DS chains anchored at the root, NSEC3 trade-offs, and the KSK rollover landing October 11, 2026.
Certificate Transparency: How Merkle Logs Ended Blind Trust in CAs
How Certificate Transparency Merkle logs, SCTs and monitors make every TLS certificate publicly auditable — and how they caught Symantec in 2015.