Security

Abstract diagram of cryptographic key exchange between browser, authenticator, and server.

Implementing WebAuthn Passkeys: Inside the FIDO2 Registration Ceremony

Inside the WebAuthn registration ceremony: how challenges are minted, how authenticators create key pairs, and what your backend needs to verify.

Abstract vault door with glowing key shards reassembling.

Inside HashiCorp Vault: Unsealing, Audit Logs, and Transit Encryption

A practitioner’s tour of three Vault primitives engineers touch daily — the Shamir-based unseal flow, the tamper-evident audit log device, and the stateless transit encryption engine — with concrete config and production patterns.

Diagram of gVisor Sentry intercepting syscalls between application and host kernel.

Inside gVisor: How User-Space Kernels Sandbox Containers at the Syscall Boundary

gVisor moves the Linux kernel into userspace to sandbox containers at the syscall boundary, trading raw throughput for a dramatically smaller attack surface.

Stylized illustration of a public key handshake between a browser and a relying party server.

Inside WebAuthn: How Passkeys Really Work Under the Hood

WebAuthn replaces shared secrets with public key cryptography bound to a device. This post walks through the registration and authentication ceremonies, the role of authenticators and the client, and why passkeys are phishing-resistant by construction.

Network packets traveling along a glowing path representing a TLS 1.3 0-RTT handshake.

Inside TLS 1.3 Zero Round-Trip Resumption: Architecture, Trade-Offs, and Production Deployment

How TLS 1.3 0-RTT cuts handshake latency to a single round trip — and the replay, forward-secrecy, and operational trade-offs you need to understand before turning it on.