Notes on Implementing Vaccine Passports
Now that we’re starting to get widespread COVID vaccination “vaccine passports” have started to become more relevant. The idea behind a vaccine passport is that you would have some kind … Read more
Eric Rescorla
Notes on Addressing Supply Chain Vulnerabilities
Addressing Supply Chain Vulnerabilities One of the unsung achievements of modern software development is the degree to which it has become componentized: not that long ago, when you wanted to … Read more
What WebRTC means for you
If I told you that two weeks ago IETF and W3C finally published the standards for WebRTC, your response would probably be to ask what all those acronyms were. Read … Read more
Why getting voting right is hard, Part V: DREs (spoiler: they’re bad)
This is the fifth post in my series on voting systems (catch up on parts I, II, III and IV), focusing on computerized voting machines. The technical term for these … Read more
Why getting voting right is hard, Part IV: Absentee Voting and Vote By Mail
This is the fourth post in my series on voting systems. Part I covered requirements and then Part II and Part III covered in-person voting using paper ballots. However, paper … Read more
Why getting voting right is hard, Part III: Optical Scan
This is the third post in my series on voting systems. For background see part I. As described in part II, hand-counted paper ballots have a number of attractive security … Read more
Why getting voting right is hard, Part II: Hand-Counted Paper Ballots
In Part I we looked at desirable properties for voting system. In this post, I want to look at the details of a specific system: hand-counted paper ballots. Hand-counted paper … Read more
Why getting voting right is hard, Part I: Introduction and Requirements
Every two years around this time, the US has an election and the rest of the world marvels and asks itself one question: What the heck is going on with … Read more
A look at password security, Part V: Disk Encryption
The previous posts ( I, II, III, IV) focused primarily on remote login, either to multiuser systems or Web sites (though the same principles also apply to other networked services … Read more
A look at password security, Part IV: WebAuthn
As discussed in part III, public key authentication is great in principle but in practice has been hard to integrate into the Web environment. However, we’re now seeing deployment of … Read more
A look at password security, Part III: More secure login protocols
In part II, we looked at the problem of Web authentication and covered the twin problems of phishing and password database compromise. In this post, I’ll be covering some of … Read more
A look at password security, Part II: Web Sites
In part I, we took a look at the design of password authentication systems for old-school multiuser systems. While timesharing is mostly gone, most of us continue to use multiuser … Read more