# Latacora Recent content in Blog on Latacora This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Stytch & Latacora: A Security Partnership Retrospective DevFeed: [Stytch & Latacora: A Security Partnership Retrospective]() Original publisher: [Read original article]() Published: 2026-05-22T16:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Security](), [Authentication](), [Incident response](), [SIEM, Security, Observability](), [supply chain attacks](), [MFA]() Tags: [2025](), [acquisition](), [authentication](), [incident-response](), [integration](), [partnership](), [retrospective](), [security](), [siem](), [supply-chain-attacks]() ### AI overview A retrospective on Stytch and Latacora's security partnership from 2021 through Stytch's acquisition by Twilio. It describes building security into passwordless authentication infrastructure, scaling detection and response, addressing SAML vulnerabilities and supply chain attacks, and maintaining monitoring during the acquisition. ### Source excerpt From growing startup to Twilio integration # Stytch and Latacora worked side by side to ensure that the developers and end users relying on Stytch's platform benefited from a security program built for the sensitivity and criticality of the data involved. This journey, which began in February 2021, saw Stytch grow from an ambitious startup building passwordless authentication infrastructure into a mature platform, ultimately acquired by Twilio. ## Latacora Achieves AWS Advanced Tier Services Partner Status DevFeed: [Latacora Achieves AWS Advanced Tier Services Partner Status]() Original publisher: [Read original article]() Published: 2026-01-27T21:00:00Z Content type: release Language: en Sources: [Latacora]() Topics: [Amazon Web Services (AWS)](), [Security & compliance, Cloud security](), [Security](), [AWS IAM](), [Monitoring](), [threat detection]() Tags: [amazon-web-services-aws](), [cloud-security](), [compliance](), [iam](), [iso-27001](), [monitoring](), [security](), [soc](), [soc-2](), [threat-detection]() ### AI overview Latacora announces that it has achieved Amazon Web Services (AWS) Advanced Tier Services Partner status within the AWS Partner Network. The company says the designation reflects validated technical expertise, AWS-certified professionals, and a proven record of customer success in cloud security and compliance. ### Source excerpt We are thrilled to announce a major milestone for Latacora: we have achieved the Amazon Web Services (AWS) Advanced Tier Services Partner status within the AWS Partner Network (APN). This designation reflects Latacora's technical expertise and diligence in delivering exceptional cloud security and compliance solutions to our clients, and confirms that we have successfully completed a rigorous validation process demonstrating a proven track record of customer success delivered by a team of AWS-certified professionals with specialized technical capabilities. ## Writing MCP servers in Clojure with Ring and Malli DevFeed: [Writing MCP servers in Clojure with Ring and Malli]() Original publisher: [Read original article]() Published: 2025-11-10T15:00:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [MCP Server](), [Clojure](), [Model Context Protocol](), [Databases](), [Large Language Model]() Tags: [clojure](), [databases](), [language-models](), [mcp](), [mcp-server](), [model-context-protocol]() ### AI overview This tutorial explains how Latacora built a compliant Model Context Protocol server for Clojure applications using Ring and the official Model Context Protocol Java SDK. It presents an open-source Clojure library for exposing Datomic database queries to LLM agents through MCP. ### Source excerpt Introduction # Large language models, agents, and Model Context Protocol (MCP) are impossible to escape in today's tech climate. At Latacora, we take a thoughtful and pragmatic approach towards new technologies like these. Are they going to solve all the world's problems? No. Is it important that we understand them and be able to build software that integrates into emerging ecosystems? Yes! Internally we've built a MCP server to query our Datomic databases using natural language, but now we're open sourcing the underlying Clojure library so others can easily build robust MCP servers for the emerging LLM agent ecosystem too. ## OIDC workload identity on AWS DevFeed: [OIDC workload identity on AWS]() Original publisher: [Read original article]() Published: 2025-11-04T15:00:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [OpenID connect (OIDC)](), [Amazon Web Services](), [AWS IAM](), [Open Source](), [Cloud](), [implementation](), [Amazon EC2]() Tags: [api](), [authentication](), [aws](), [aws-iam](), [identity](), [oidc](), [open-source](), [vpc]() ### AI overview This article explains workload identity on AWS and presents aws-oidc-token-exchange, an open-source bridge that allows AWS workloads to authenticate to OIDC-based services using existing IAM identities. It describes short-lived, platform-issued identity tokens as an alternative to managing API keys, passwords, and certificates. ### Source excerpt Update: after years of being on the wish list of a ton of top AWS teams, AWS released a built-in version of this feature about two weeks after we published this. Never let it be said gentle ribbing doesn't work. Also, thanks AWS! We meant it when we said that the only thing better than having something easy to deploy was not needing to deploy anything at all. Everything in this post about workload identity is still relevant but you should probably use upstream's implementation unless you have a good reason not to (for example, private validators for whom you need a VPC endpoint). ## ECS on EC2: Covering Gaps in IMDS Hardening DevFeed: [ECS on EC2: Covering Gaps in IMDS Hardening]() Original publisher: [Read original article]() Published: 2025-10-02T18:18:59Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Amazon Elastic Container Service](), [Amazon EC2](), [Security](), [Amazon Web Services](), [Containers](), [Credential theft]() Tags: [aws](), [containers](), [credential-theft](), [credentials](), [ec2](), [ecs](), [hardening](), [security](), [sensitive-data]() ### AI overview This article examines security gaps in Amazon ECS workloads running on EC2, focusing on task isolation and restricting access to the EC2 Instance Metadata Service. It discusses how weak isolation can expose credentials and sensitive data and outlines the need for more comprehensive hardening guidance. ### Source excerpt Introduction # AWS ECS is a widely-adopted service across industries. To illustrate the scale and ubiquity of this service, over 2.4 billion Amazon Elastic Container Service tasks are launched every week (source) and over 65% of all new AWS containers customers use Amazon ECS (source). There are two primary launch types for ECS: Fargate and EC2. The choice between them depends on factors like cost, performance, operational overhead, and the variability of your workload. ## Introducing Replik8s, a Modern Security Tool for Kubernetes DevFeed: [Introducing Replik8s, a Modern Security Tool for Kubernetes]() Original publisher: [Read original article]() Published: 2025-09-22T16:00:00Z Content type: release Language: en Sources: [Latacora]() Topics: [Kubernetes](), [Security](), [Kubernetes clusters](), [Open Source](), [Incident response](), [AI Agent]() Tags: [ai-agent](), [incident](), [incident-response](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [mcp](), [other](), [security](), [security-tools](), [trivy]() ### AI overview Latacora introduces Replik8s, an open-source Kubernetes tool that snapshots cluster data, serves historical snapshots through a mirror API, supports kubectl and Trivy workflows, and provides query-based analysis for auditing and investigation. ### Source excerpt Introduction # Security tools are often designed to highlight specific issues by consuming APIs and applying predefined logic. Each tool implements its own data structures, storage formats, and evaluation logic. While effective in narrow contexts, this approach creates challenges for teams managing a diverse toolset. Moreover, most tools are optimized to fetch only the data needed for specific findings, limiting their utility in broader contexts such as incident response or historical analysis. ## Bit by bit: how Latacora helped Notion build security that scales DevFeed: [Bit by bit: how Latacora helped Notion build security that scales]() Original publisher: [Read original article]() Published: 2025-08-29T16:55:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Notion](), [Security](), [Application Security](), [cloud-infrastructure](), [GitHub](), [Google Cloud Platform (GCP)](), [SIEM, Security]() Tags: [application-security](), [aws](), [azure](), [cloud](), [cloud-infrastructure](), [github](), [google-cloud](), [security](), [siem]() ### AI overview A case study of how Notion partnered with Latacora from 2019 to build a security program while the company was growing, designing an API, and responding to customer security questions. The engagement covered foundational security work, hiring decisions, cloud and developer platforms, and SIEM tooling. ### Source excerpt Security rarely tops the priority list for startups - but that doesn't make it optional. Running a startup is no small feat. Facing enormous pressure to address a never-ending list of priorities (finding market fit, fundraising, launching new features, scaling infrastructure, etc.) security often becomes a "later" issue......until it can't be. Even when companies know they need help, the breadth of the problem can be intimidating. Application security, cloud infrastructure, third-party vendors, compliance, cryptography: any resource-constrained startup will be hard-pressed to find a unicorn hire who can own all these responsibilities equally well. ## Privacy for the newly appointed (and already exasperated) DPO DevFeed: [Privacy for the newly appointed (and already exasperated) DPO]() Original publisher: [Read original article]() Published: 2025-06-27T16:09:35Z Content type: opinion Language: en Sources: [Latacora]() Topics: [dpo](), [data](), [trust]() Tags: [compliance](), [data-protection](), [dpo](), [gdpr](), [law](), [privacy](), [trust]() ### AI overview This article offers guidance for startup employees responsible for privacy and data protection, including newly appointed Data Protection Officers. It argues that transparency, privacy by design, and data minimization help businesses maintain compliance and build customer trust, while noting the extraterritorial reach of the EU GDPR and China's PIPL. ### Source excerpt Every other week, regulators around the world bombard their constituents with new data protection laws and acronyms. As the person who was just voluntold you're now responsible for privacy at your startup, in addition to all your other duties and without any additional resources, how can you possibly be expected to keep up--let alone contextualize that information to maintain compliance? Privacy, at its core, is an ethical issue, which means the solution to your privacy challenges is deceptively simple: do the right thing and be transparent with your customers. That's it. That's what everyone means when they say "privacy by design." ## Lessons in logging, part 2: mapping your path to a mature security program with logs and audit trails DevFeed: [Lessons in logging, part 2: mapping your path to a mature security program with logs and audit trails]() Original publisher: [Read original article]() Published: 2024-10-23T15:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Logging](), [Security](), [log management](), [observability]() Tags: [audit](), [audit-trail](), [logging](), [logs](), [observability](), [privacy](), [security]() ### AI overview The second post in a series examines how logging and audit trails support a mature security program. It compares using existing logging infrastructure with implementing independent audit events, discussing implementation tradeoffs, complexity, privacy, and security-team tooling. ### Source excerpt This post is the second in a series about logging and audit trails from a security perspective. For the first post in the series, see Lessons in Logging: Chopping Down Security Risks Using Audit Trails If you're looking to level up your security practices, logging is a good place to focus your attention. Just as logging is a core pillar of observability, comprehensive audit trails are a core pillar of a strong security program. Logs and audit trails are separate but overlapping concepts, and most companies can improve their security posture by investing in this area. ## Datomic and Datalog for Complex Data Queries DevFeed: [Datomic and Datalog for Complex Data Queries]() Original publisher: [Read original article]() Published: 2024-09-13T17:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Databases](), [data](), [Security](), [Clojure](), [Programming](), [Amazon S3]() Tags: [analysis](), [aws](), [clojure](), [data](), [database](), [programming](), [s3](), [security]() ### AI overview Latacora describes moving from service-configuration snapshots stored in Amazon S3 toward Datomic, whose immutable facts and Datalog queries support complex questions across security data and relationships between resources. ### Source excerpt Latacora collects and analyzes data about services our clients use. You may have read about our approach to building security tooling, but the tl;dr is we make requests to all the (configuration metadata) read-only APIs available to us and store the results in S3. We leverage the data to understand our clients' infrastructure and identify security issues and misconfigurations. We retain the files ("snapshots") to support future IR/forensics efforts. This approach has served us well, but the limited scope of a snapshot meant there was always a problem of first needing to figure out which files to look at. We love aws s3 sync and grep as much as anyone but security analysis requires looking for complex relationships between resources; text search is, at best, only a Bloom filter. What we really wanted was a performant way to ask any question across all the data we have for a client that would support complex queries using logic programming. ## Latacora Partners with Vanta as a Managed Service Provider DevFeed: [Latacora Partners with Vanta as a Managed Service Provider]() Original publisher: [Read original article]() Published: 2024-09-09T16:30:00Z Content type: release Language: en Sources: [Latacora]() Topics: [Security](), [soc 2 compliance](), [trust](), [Business Security](), [Incident response]() Tags: [automation](), [compliance](), [incident-response](), [partner](), [security](), [soc-2-compliance](), [trust](), [vanta]() ### AI overview Latacora announces a partnership with Vanta as a managed service provider. The arrangement combines Latacora's security expertise with Vanta's compliance platform and offers monthly billing, extended compliance support, and planned integrations. ### Source excerpt Exciting news! Latacora is teaming up with Vanta to supercharge your compliance game. We now combine Latacora's security expertise with Vanta's compliance platform to help you reach your compliance goals faster than ever. As a Vanta managed service provider (MSP), Latacora can help you tackle your compliance goals quickly and efficiently, freeing you to focus on growing your business and building trust with your customers. Here's the scoop on why using Vanta through Latacora is a game-changer: ## Cryptographic Right Answers: Post Quantum Edition DevFeed: [Cryptographic Right Answers: Post Quantum Edition]() Original publisher: [Read original article]() Published: 2024-07-29T17:25:48Z Content type: article Language: en Sources: [Latacora]() Topics: [Post-quantum cryptography](), [Cryptography](), [recommendations]() Tags: [academic-research](), [cryptography](), [guide](), [post-quantum-cryptography]() ### AI overview This article updates cryptography recommendations for the transition to post-quantum cryptography. It explains that PQC involves more varied tradeoffs than classical cryptography and that some promising systems have failed, making recommendations harder to assess confidently. ### Source excerpt One of our favorite blog posts is our "crypto right answers" post. It's intended to be an easy-to-use guide to help engineers pick the best cryptography choices without needing to go too far down a rabbit hole. With post-quantum cryptography (PQC) recently transitioning from an academic research topic to a more practical cryptography concern we figured it's time for an update of our cryptography recommendations. One thing that makes recommending PQC challenging is that historically, we've been able to provide "better" answers for classical cryptography. Faster and bigger hashes, stronger password KDFs, easier-to-use primitives... These things all have the same fundamental "shape": you can take an existing design and drop in something else to make it better. MD5 and BLAKE3 are not comparable in strength, but you can just use BLAKE3 in place of MD5 and get something that's just far better with minimal API changes. ## Real World Crypto 2024 DevFeed: [Real World Crypto 2024]() Original publisher: [Read original article]() Published: 2024-05-07T11:00:17Z Content type: article Language: en Sources: [Latacora]() Topics: [Cryptography](), [Certificate Transparency](), [Security, Privacy and Abuse Prevention](), [Post-Quantum]() Tags: [browsers](), [certificate-transparency](), [cryptography](), [internet](), [post-quantum](), [privacy](), [public-key](), [security]() ### AI overview A blog post records notes from Real World Crypto 2024 in Toronto, discussing applied cryptography trends including post-quantum messaging, key transparency, and privacy-enhancing technologies. It also describes Certificate Transparency's Levchin Prize recognition and its role in improving accountability for the Web Public Key Infrastructure. ### Source excerpt We traveled to Toronto this year to attend RWC 2024. The conference was held in TIFF Lightbox located in the city's downtown; the venue is the headquarters for the Toronto Film Festival and contains five cinema rooms. RWC is a single-tracked conference and there's no hard requirement that talks are backed by papers. Each RWC includes the Levchin prize ceremony for major achievements in applied cryptography, several invited talks and the lightning talks session. ## A case for password hashing with delegation DevFeed: [A case for password hashing with delegation]() Original publisher: [Read original article]() Published: 2023-12-22T15:18:16Z Content type: article Language: en Sources: [Latacora]() Topics: [passwords](), [hashing](), [Security](), [Encryption](), [Cryptography]() Tags: [cryptographic](), [delegation](), [encryption](), [hashing](), [parallel](), [password](), [security]() ### AI overview This article explains password-based key derivation functions and examines delegated password hashing, in which computation is offloaded to an untrusted server. It discusses how delegation could increase the work factor for systems constrained by weaker devices, with particular attention to encryption-key derivation in end-to-end encrypted backup systems. ### Source excerpt When people talk about PBKDFs (Password Based Key Derivation Functions), this is usually either in the context of secure password storage, or in the context of how to derive cryptographic keys from potentially low-entropy passwords. The Password Hashing Competition (PHC, 2013-2015) was an open competition to derive new password hashing algorithms, resulting in Argon2 hash as its winner. Apart from achieving general hash security, many of the candidates focused on achieving resistance to parallel attacks on available hardware such as GPUs. ## Lessons in logging: chopping down security risks using audit trails DevFeed: [Lessons in logging: chopping down security risks using audit trails]() Original publisher: [Read original article]() Published: 2023-11-28T15:30:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Logging](), [audit](), [Security](), [Architecture & Design]() Tags: [audit](), [logging](), [logs](), [secure-by-design](), [security]() ### AI overview This first post in a series explains logging and audit trails from a security perspective. It introduces secure logging requirements and describes how logs can support threat identification, incident investigation, remediation, and tracking user access or changes over defined time windows. ### Source excerpt This post is the first in a series about logging and audit trails from a security perspective. For the next post in the series, see Lessons in Logging, Part 2: Mapping Your Path to a Mature Security Program with Logs and Audit Trails At Latacora, we bootstrap security practices. We partner with companies that frequently have minimally developed security programs, work with them to figure out the right security practices for their current size, and then help them evolve and scale those practices as their business matures. ## Our Approach to Building Security Tooling DevFeed: [Our Approach to Building Security Tooling]() Original publisher: [Read original article]() Published: 2023-11-01T16:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Tooling](), [Security](), [Monitoring](), [Incident response]() Tags: [api](), [building](), [code](), [configuration](), [data](), [fetching](), [github](), [incident-response](), [monitoring](), [security](), [snapshot](), [storage](), [tooling]() ### AI overview The article describes a security-tooling strategy that captures all available API data, stores it in its original request-and-response format as snapshots, and evaluates it later through queries. This is presented as more flexible than tools that fetch only data needed for predefined findings, particularly for exploratory work and incident response. ### Source excerpt Introduction # Most "security tools" today are typically composed by code that consumes an API and applies predefined logic to identify issues. This is generally accomplished by: Fetching a subset of the endpoints exposed by the service / API being audited (that is, the information required for the evaluation logic, such as a list of the EC2 instances deployed in an AWS account, as well as their configuration) Storing the data retrieved Evaluating this data to produce "findings" (this is the added value provided by the tool) Integrating third party tools into our monitoring platform isn't always straightforward, as each tool: ## Frequently Asked Questions from Strange Loop 2023 DevFeed: [Frequently Asked Questions from Strange Loop 2023]() Original publisher: [Read original article]() Published: 2023-09-27T20:37:33Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Security](), [Application Security](), [Security & compliance, Cloud security]() Tags: [application-security](), [cloud-security](), [conference](), [developer](), [incident-response](), [it-security](), [security](), [siem]() ### AI overview Latacora describes its sponsorship of Strange Loop 2023, the questions attendees asked at its booth, and its security consultancy and service offerings. The article says the sponsorship was intended to support a developer-focused conference and bring people together, rather than generate sales leads or job applicants. ### Source excerpt The last Strange Loop conference was held September 21-22, 2023 at St. Louis Union Station. The conference is targeted towards developers; the speakers are often sharing their knowledge on new and inventive ways to use technology. At our sponsor booth at Union Station, attendees asked two (okay, three) questions most often: What is Latacora? Your name is on the lanyards, and I'm curious to know what you do. Why sponsor Strange Loop? Can I take a plant? The first one isn't hard for the folks from our team: Latacora is a consultancy that bootstraps security for startups. We have a team of experts helping our clients with most security-related things: application security, cloud security, corporate security, compliance, and more. We also have a team of security architects, cryptographers, and project managers supporting our clients. These professionals are equipped with power tools built to make their jobs more efficient and to help our clients improve their security posture. ## Remediating AWS IMDSv1 DevFeed: [Remediating AWS IMDSv1]() Original publisher: [Read original article]() Published: 2021-08-11T16:16:23Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Amazon Web Services](), [Amazon EC2](), [AWS IAM](), [Exploit](), [vulnerability](), [Amazon Simple Queue Service (SQS)](), [DynamoDB]() Tags: [aws](), [bugs](), [credentials](), [defense-in-depth](), [dynamodb](), [ec2](), [exploit](), [iam](), [infrastructure](), [sqs](), [technical](), [vulnerability]() ### AI overview This technical article explains why AWS Instance Metadata Service version 1 is risky. Applications vulnerable to SSRF, XXE, or RCE may allow attackers to obtain temporary IAM role credentials from EC2-hosted applications and use them to access AWS services. The article presents defense in depth as a way to limit the impact of application vulnerabilities, although the supplied text ends before the remediation details. ### Source excerpt 2024-12-17 Updated to include Declarative Policies Compute resources in AWS (for example, EC2 instances, ECS tasks/services, etc.) get access to AWS credentials, such as temporary instance role credentials, via the Instance Metadata Service (IMDS). The compute resources use these credentials to access other AWS services such as SQS, DynamoDB and Secrets Manager. Introduction: Problems with IMDSv1 # There was originally only one version of IMDS, now called "v1," which unfortunately many people still use. The technical risks and high profile incidents (the Capital One breach comes to mind) associated with v1, as well as the existence of v2 are well-documented. When an application hosted on an EC2 instance is vulnerable to SSRF, XXE or RCE, attackers can likely steal the temporary AWS credentials of the IAM role configured for the instance. This service is a particularly interesting target for attackers: ## Seven Practices to Prepare a Startup for SOC 2 DevFeed: [Seven Practices to Prepare a Startup for SOC 2]() Original publisher: [Read original article]() Published: 2020-03-12T17:49:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [soc2](), [Security](), [Terraform](), [CI/CD](), [Google Cloud Identity](), [okta](), [Logging](), [Provisioning](), [AWS CloudTrail](), [protected branches](), [GitHub]() Tags: [aws](), [ci-cd](), [cloudtrail](), [deployment](), [github](), [logging](), [okta](), [patches](), [protected-branches](), [security](), [soc2](), [terraform]() ### AI overview The article recommends seven practices for startups that expect large-company clients to require a SOC 2 report: centralized identity with 2FA, pull-request controls and CI/CD, centralized logging, infrastructure provisioning with Terraform or a similar tool, AWS CloudTrail and AssumeRole, device management with encryption and current patches, and software vendor risk tracking. It also recommends documenting basic policies. ### Source excerpt So, you plan to sell your startup's product to big companies one day. Congratu-dolences! Really, that's probably the only reason you should care about this article. If that's not you, go forth and live your life! We'll ask no more of your time. For the rest of you: Industry people talk about SOC2 a lot, and it's taken on a quasi-mystical status, not least because it's the product of the quasi-mystical accounting industry. But what it all boils down to is: eventually you'll run into big-company clients demanding a SOC2 report to close a sale. You know this and worry about it. ## Why encrypted email remains unsafe, according to the article DevFeed: [Why encrypted email remains unsafe, according to the article]() Original publisher: [Read original article]() Published: 2020-02-19T18:50:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [email](), [Encryption](), [Cryptography](), [Security](), [Internet]() Tags: [cryptography](), [email](), [encryption](), [internet](), [messages](), [pgp](), [privacy](), [security](), [signal]() ### AI overview The article argues that encrypted email remains unsafe even if flaws in current tools such as PGP are fixed. It attributes the problem to email's plaintext-oriented foundations and the likelihood of unencrypted replies, and advises against sending messages that require serious security over email. ### Source excerpt Email is unsafe and cannot be made safe. The tools we have today to encrypt email are badly flawed. Even if those flaws were fixed, email would remain unsafe. Its problems cannot plausibly be mitigated. Avoid encrypted email. Technologists hate this argument. Few of them specialize in cryptography or privacy, but all of them are interested in it, and many of them tinker with encrypted email tools. Most email encryption on the Internet is performative, done as a status signal or show of solidarity. Ordinary people don't exchange email messages that any powerful adversary would bother to read, and for those people, encrypted email is LARP security. It doesn't matter whether or not these emails are safe, which is why they're encrypted so shoddily. ## How (not) to sign a JSON object DevFeed: [How (not) to sign a JSON object]() Original publisher: [Read original article]() Published: 2019-07-24T12:50:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Cryptography](), [Encryption](), [JSON](), [API](), [JSON Web Tokens](), [ECDSA]() Tags: [api](), [cryptography](), [ecdsa](), [encryption](), [json](), [jwt](), [sha256](), [signing]() ### AI overview The article explains how to authenticate JSON data in transit. It recommends HMAC-based symmetric signing for most cases, while noting that embedding a signature inside a JSON object creates parsing and interoperability challenges. ### Source excerpt Last year we did a blog post on interservice auth. This post is mostly about authenticating consumers to an API. That's a related but subtly different problem: you can probably impose more requirements on your internal users than your customers. The idea is the same though: you're trying to differentiate between a legitimate user and an attacker, usually by getting the legitimate user to prove that they know a credential that the attacker doesn't. ## PGP's Legacy Design and Cryptographic Deficiencies DevFeed: [PGP's Legacy Design and Cryptographic Deficiencies]() Original publisher: [Read original article]() Published: 2019-07-17T01:14:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Cryptography](), [Encryption](), [Security, Privacy and Abuse Prevention]() Tags: [certificates](), [compression](), [crypto](), [cryptography](), [defects](), [parsing](), [passwords](), [pgp](), [signing]() ### AI overview This commentary argues that PGP has significant design and cryptographic deficiencies rooted in its 1990s origins. It examines the complexity of PGP's packet structure, key management, parsing, compression, signing, and encryption features. ### Source excerpt Cryptography engineers have been tearing their hair out over PGP's deficiencies for (literally) decades. When other kinds of engineers get wind of this, they're shocked. PGP is bad? Why do people keep telling me to use PGP? The answer is that they shouldn't be telling you that, because PGP is bad and needs to go away. There are, as you're about to see, lots of problems with PGP. Fortunately, if you're not morbidly curious, there's a simple meta-problem with it: it was designed in the 1990s, before serious modern cryptography. No competent crypto engineer would design a system that looked like PGP today, nor tolerate most of its defects in any other design. Serious cryptographers have largely given up on PGP and don't spend much time publishing on it anymore (with a notable exception). Well-understood problems in PGP have gone unaddressed for over a decade because of this. ## Analyzing a simple encryption scheme using GitHub SSH keys DevFeed: [Analyzing a simple encryption scheme using GitHub SSH keys]() Original publisher: [Read original article]() Published: 2018-09-30T17:54:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Encryption](), [Cryptography](), [GitHub](), [ssh](), [openssl](), [OpenSSH](), [SSL](), [Command-line interface]() Tags: [attacks](), [channel](), [encryption](), [github](), [openssl](), [padding](), [public-key](), [rsa](), [ssh](), [ssl]() ### AI overview This introductory analysis examines encrypting secrets for recipients using their GitHub SSH public keys and an OpenSSL RSA command. It explains that the scheme's PKCS#1 v1.5 and SSLv2 padding variants are vulnerable to Bleichenbacher's oracle attack, while noting that the described offline threat model does not provide access to a decryption oracle. ### Source excerpt (This is an introductory level analysis of a scheme involving RSA. If you're already comfortable with Bleichenbacher oracles you should skip it.) Someone pointed me at the following suggestion on the Internet for encrypting secrets to people based on their GitHub SSH keys. I like the idea of making it easier for people to leverage key material and tools they already have. The encryption instructions are: echo "my secret" > message.txt curl -q "https://github.com/${USER}.keys" \ | head -n 1 \ > recipient.pub ssh-keygen -e -m pkcs8 -f recipient.pub > recipient.pem openssl rsautl \ -encrypt \ -pubin \ -inkey recipient.pem \ -ssl \ -in message.txt \ -out encrypted.txt Anything using an openssl command line tool makes me a little uncomfortable. Let's poke at it a little. ## ROCA vs. ROBOT: Comparing Candidates for the 2018 Best Cryptographic Attack Pwnie Award DevFeed: [ROCA vs. ROBOT: Comparing Candidates for the 2018 Best Cryptographic Attack Pwnie Award]() Original publisher: [Read original article]() Published: 2018-08-08T22:52:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Cryptography](), [Exploit](), [Security, Privacy and Abuse Prevention](), [email](), [TLS (Transport Layer Security)]() Tags: [black-hat](), [conference](), [crypto](), [exploit](), [rsa](), [vulnerabilities]() ### AI overview This commentary compares the ROCA RSA key generation flaw and the ROBOT "Return Of Bleichenbacher" attack as candidates for the 2018 Best Cryptographic Attack Pwnie award. It also considers Efail and IOTA as notable cryptographic research and attack work from the same period. ### Source excerpt The ROCA RSA key generation flaw or ROBOT, the "Return Of Bleichenbacher" attack: which is most deserving of the "Best Cryptographic Attack" Pwnie award at the 2018 Black Hat USA conference? Only one can survive. Let us consider. Assume for the moment that it's down to those two: ROBOT and ROCA. But first take a moment to consider the best cases for the "runners up". They are all excellent; it was a very good year for crypto research. [Next page]()