Tag: security
Timing Attacks
Side-channel attacks that infer secret values by measuring how long an operation takes — a string comparison that short-circuits on the first mismatch leaks information about the secret one character at a time.
CWE-208
2mo ago
security advanced
TLS Certificate Lifecycle
The end-to-end process of generating, validating, issuing, deploying, monitoring, and renewing a TLS certificate — and what breaks at each stage when it goes wrong.
2mo ago
cryptography intermediate
Type Coercion in Authentication Checks
PHP 4.0+
PHP's loose comparison (==) coerces types — '0e123' == '0e456' (both 0 in scientific notation), and 0 == 'admin' — always use === for authentication comparisons.
2mo ago
security advanced
Tagged Template Literals
ES2015
A function prefix on a template literal — the tag function receives the string parts and interpolated values separately, enabling safe SQL, HTML, CSS, and i18n string construction.
3mo ago
javascript intermediate
Threat Modelling
PHP 5.0+ A structured analysis process for identifying security threats, attack vectors, and appropriate countermeasures during design.
3mo ago
general intermediate
TLS Handshake
2
The negotiation process between client and server that establishes an encrypted HTTPS connection, agreeing on cipher suites and exchanging keys.
3mo ago
networking intermediate
Type Coercion
PHP 7.0+
PHP's automatic conversion between types can produce unexpected comparison results, leading to logic bugs and security bypasses.
CWE-704 OWASP A3:2021
3mo ago
php intermediate
8.1