Security and cryptography

See how attacks work and what actually stops them.

Sessions

Go in order. Each session is one idea you can drag, step and break.

3 live · 4 coming

The building blocks.

Interactive
Coming soon
Hash functions
Same input, same output; tiny change, completely different output.
Interactive
Live
Storing passwords
Salts, bcrypt and argon2, and why plain hashes fail.
Open session →
Interactive
Coming soon
Symmetric encryption
One shared key to lock and unlock.
Interactive
Coming soon
Public-key cryptography
A public key to lock, a private key to unlock.
Interactive
Live
Key exchange
Two strangers agree on a secret over a public channel.
Open session →
Interactive
Live
Digital signatures
Prove who sent a message and that nobody changed it.
Open session →
Interactive
Coming soon
Randomness and nonces
Why predictable random numbers break everything.

1 live · 3 coming

Trusting who you're talking to.

Interactive
Coming soon
The TLS handshake
Certificates, key exchange and the first encrypted byte.
Interactive
Live
Certificates and certificate authorities
The chain of trust from your site to the browser.
Open session →
Interactive
Coming soon
Mutual TLS
Both sides prove who they are.
Interactive
Coming soon
HTTPS everywhere and HSTS
Stop downgrades to plain HTTP.

2 live · 5 coming

Who is this, and what may they do?

Interactive
Coming soon
Sessions and cookies
Stay logged in, and the cookie flags that matter.
Interactive
Live
JWTs
What's inside a token, and the mistakes that make it forgeable.
Open session →
Interactive
Live
The OAuth 2.0 flow
Authorization code with PKCE, step by step.
Open session →
Interactive
Coming soon
OpenID Connect
Sign in with another provider.
Interactive
Coming soon
Passkeys and WebAuthn
Log in with a device instead of a password.
Interactive
Coming soon
Multi-factor authentication
Codes, push and hardware keys, and which ones get phished.
Interactive
Coming soon
Authorization models
RBAC, ABAC and relationship-based access.

5 live · 1 coming

How common attacks work, and the fix for each.

Already live in other tracks: CORS, Content Security Policy

0 live · 6 coming

Writing code that's hard to attack.

Interactive
Coming soon
Input validation and output encoding
Check what comes in, escape what goes out.
Interactive
Coming soon
Handling secrets
Keys in code, logs and images, and getting them out.
Interactive
Coming soon
Dependency and supply-chain risks
A compromised package in your build.
Interactive
Coming soon
Security headers
The headers that switch on browser protections.
Interactive
Coming soon
Brute force and abuse
Rate limits, lockouts and CAPTCHAs.
Interactive
Coming soon
Security logging
Log what you need to investigate, and nothing sensitive.

0 live · 4 coming

Protecting the systems underneath.

Interactive
Coming soon
Least privilege
Give every person and service only what it needs.
Interactive
Coming soon
Network segmentation
Limit how far an attacker can move once inside.
Interactive
Coming soon
Zero trust
Check every request, even from inside the network.
Interactive
Coming soon
Encryption at rest and key management
Encrypt the data, and protect and rotate the keys.

0 live · 4 coming

Making security part of the work.

Interactive
Coming soon
Threat modeling
Find what could go wrong before you build it.
Interactive
Coming soon
The OWASP Top 10
The most common web risks, and how to check for each.
Interactive
Coming soon
Penetration testing
Attack your own system the way an attacker would.
Interactive
Coming soon
Security incidents and disclosure
What to do when you're breached, and telling users.

0 live · 2 coming

New attacks on AI features.

Interactive
Coming soon
Prompt injection, as an attacker sees it
Hide instructions in a document and take over the agent.
Interactive
Coming soon
Data exfiltration through agents
Trick an agent into sending private data out.

In production