{"author":"Jan Brennenstuhl","findings":"https://www.janbrennenstuhl.eu/findings.json","items":[{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/glossary/","claim":"","content_hash":"sha256:bdfa4f530ee8bb118f21e0a7de138d1322913b828b64f34b592bbe4341b49394","description":"Short definitions of the identity, token, password and agent terms used across the site.","findings":0,"id":"jb-glossary","kind":"glossary","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/glossary/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/page/glossary/index.md","status":"published","title":"Glossary","topics":[]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/","claim":"In MCP revision 2026-07-28, a protected MCP server over HTTP is an OAuth 2.1 resource server that accepts only tokens issued for itself.","content_hash":"sha256:6230eea44d9d67fe74c46232bb88963e020b67f868ae936ea1da120f1e7deee0","description":"What the Model Context Protocol authorization specification, revision 2026-07-28, requires from MCP servers, clients and authorization servers.","findings":4,"id":"jb-guide-mcp-authorization","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#for-product-and-ux"},{"id":"how-it-works","title":"How it works","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#how-it-works"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/agent-identity/mcp-authorization/index.md","status":"published","title":"How does authorization work for MCP servers?","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/","claim":"People should grant an agent access per service with chosen permissions and an expiry, and be able to revoke that grant at any time.","content_hash":"sha256:7ffaec36c74d565f0b154c8342aeea5658fb9808c81200e5a4abd747f13208f1","description":"How to let people give an agent narrow, time-limited access to a service and take it back, based on the OAuth revocation and security RFCs.","findings":4,"id":"jb-guide-consent-and-revocation","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#for-product-and-ux"},{"id":"how-it-works","title":"How it works","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#how-it-works"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/agent-identity/consent-and-revocation/index.md","status":"published","title":"How should people grant and revoke an agent's access?","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/","claim":"OAuth 2.0 Token Exchange (RFC 8693) lets a gateway trade an agent's token for a provider token, so the provider token never has to reach the agent.","content_hash":"sha256:99a9cc4380416fadc6eb3cc6c0e6cb8f45de5b9c7f0b629b6f9123d0b9a07d6d","description":"How RFC 8693 token exchange lets a gateway trade an agent's token for a provider token so the agent never holds the provider token.","findings":5,"id":"jb-guide-token-exchange","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#for-product-and-ux"},{"id":"how-it-works","title":"How it works","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#how-it-works"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/agent-identity/token-exchange/index.md","status":"published","title":"How does OAuth 2.0 Token Exchange keep provider tokens away from agents?","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/","claim":"A signed JWT's claims are readable by anyone who holds it; trust comes only from verifying the signature with an allowed algorithm and a trusted key.","content_hash":"sha256:d9a79f23a51f7150c491709a572d53a5d28a20819ea5100fde5d77c0ddaf0848","description":"The 3 parts of a signed JSON Web Token, what each one contains, and why reading a token is not the same as trusting it.","findings":4,"id":"jb-guide-jwt-anatomy","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#for-product-and-ux"},{"id":"try-it","title":"Try it","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#try-it"},{"id":"how-the-parts-fit-together","title":"How the parts fit together","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#how-the-parts-fit-together"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/oidc/jwt-anatomy/index.md","status":"published","title":"What is inside a JWT?","topics":["tokens-jwt","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/","claim":"NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords, forbids composition rules and periodic changes, and requires blocklist checks and support for password managers.","content_hash":"sha256:a3d15a42485a4565438bcf1383e2a053771e675bb2e2e76f4e0cf68cbda558d8","description":"What NIST SP 800-63B-4 requires from a password policy, and a checker that compares your own policy against it.","findings":4,"id":"jb-guide-password-policy-requirements","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#for-product-and-ux"},{"id":"check-your-policy","title":"Check your policy","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#check-your-policy"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/password-policy-requirements/index.md","status":"published","title":"What should a password policy require?","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/","claim":"An agent that acts for a person should use delegated access that names both the person and the agent.","content_hash":"sha256:12a295ac9f426ab0abcfcab9983561b6c58a92e946c60af94829f2d97c12aa10","description":"Why an agent that acts for people needs delegated access tied to each person, and when a robot account still fits.","findings":4,"id":"jb-guide-delegation-vs-robot-accounts","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2026-10-13T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#for-product-and-ux"},{"id":"how-it-works","title":"How it works","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#how-it-works"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/agent-identity/delegation-vs-robot-accounts/index.md","status":"published","title":"Should an agent use a robot account or delegated access?","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/","claim":"Coding agents can build security-critical software when people own the specs, the constitution and specs live in the repository, tests must fail first, and more agents review than write.","content_hash":"sha256:32f1cd65ac039b248d7dd8f348145124a6655774e1112973c35ad0b6486566d5","description":"Lessons from 10 months of building the open-source Agentic Identity Broker with coding agents: Spec Kit, tests that tested nothing, 6 harness switches, and review.","findings":3,"id":"jb-agentic-identity-broker","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/index.md","modified":"2026-09-27T00:00:00+02:00","published":"2026-09-24T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-09-24","sections":[{"id":"why-we-started-with-agent-identity","title":"Why We Started With Agent Identity","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#why-we-started-with-agent-identity"},{"id":"we-used-spec-kit-from-the-first-day","title":"We Used Spec Kit From the First Day","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#we-used-spec-kit-from-the-first-day"},{"id":"early-models-wrote-tests-that-tested-nothing","title":"Early Models Wrote Tests That Tested Nothing","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#early-models-wrote-tests-that-tested-nothing"},{"id":"i-wrote-skills-for-the-libraries-the-models-didnt-know","title":"I Wrote Skills for the Libraries the Models Didn’t Know","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#i-wrote-skills-for-the-libraries-the-models-didnt-know"},{"id":"why-i-switched-harnesses-6-times","title":"Why I Switched Harnesses 6 Times","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#why-i-switched-harnesses-6-times"},{"id":"review-takes-more-agents-than-writing","title":"Review Takes More Agents Than Writing","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#review-takes-more-agents-than-writing"},{"id":"what-we-havent-solved-yet","title":"What We Haven’t Solved Yet","url":"https://www.janbrennenstuhl.eu/agentic-identity-broker/#what-we-havent-solved-yet"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/agentic-identity-broker/index.md","status":"published","title":"What I Learned Building an Identity Broker With Coding Agents","topics":["agentic-engineering"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/","claim":"Agents should not hold shared, long-lived provider credentials; an identity broker ties delegated access to both person and agent, and a gateway keeps provider tokens out of the agent.","content_hash":"sha256:c6ceef6d0b8c766210137538365afd1a321ca23af65797645e4117cf01b66b3a","description":"Why you need an identity broker — with Magnus Jungsbluth at AGNTCon + MCPCon Europe.","findings":0,"id":"jb-talk-agntcon-2026","kind":"talk","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/index.md","modified":"2026-09-18T00:00:00+02:00","published":"2026-09-18T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-09-18","sections":[{"id":"materials","title":"Materials","url":"https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/#materials"},{"id":"reading-companion","title":"Reading companion","url":"https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/#reading-companion"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/talks/economies-of-scale-for-mcp/index.md","status":"published","title":"Economies of Scale for MCP and Agents","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/projects/agentic-identity-broker/","claim":"Agentic Identity Broker gives agents scoped, revocable access to tools on behalf of people, keeping both user and agent in authorization decisions and provider tokens out of the agent's context.","content_hash":"sha256:dfc01742ff0ac39e2724a54ff6a8e32259fa79ce9881dbd2a9aa87bb3feb3e82","description":"Scoped, revocable access to tools for agents acting on behalf of people.","findings":0,"id":"jb-project-aib","kind":"project","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/projects/agentic-identity-broker/index.md","modified":"2026-09-15T00:00:00+02:00","published":"2026-09-15T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-09-15","sections":[{"id":"explore-the-project","title":"Explore the project","url":"https://www.janbrennenstuhl.eu/projects/agentic-identity-broker/#explore-the-project"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/projects/agentic-identity-broker/index.md","status":"published","title":"Agentic Identity Broker","topics":["agentic-engineering","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/","claim":"AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents.","content_hash":"sha256:db62daf71ff0a3a2a2e24edaea0845982c4637f8d7ea5102fc0d829c88c9a74e","description":"Guest lecture for the cybersecurity course at HTW Berlin on how coding agents move AppSec toward harness design, platform constraints and measurable risk.","findings":0,"id":"jb-talks-htw-berlin-agentic-appsec","kind":"talk","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/index.md","modified":"2026-07-03T00:00:00+02:00","published":"2026-07-03T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-07-03","sections":[{"id":"materials","title":"Materials","url":"https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/#materials"},{"id":"reading-companion","title":"Reading companion","url":"https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/#reading-companion"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/talks/htw-berlin-agentic-appsec/index.md","status":"published","title":"AppSec in the Age of Agentic Engineering","topics":["agentic-engineering","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/","claim":"AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents.","content_hash":"sha256:d2fbf7fef7f7221dbb2adb2708a1316afe3c199ff639e09218f8cf0b0cd614ef","description":"My HTW Berlin guest lecture explains why agentic engineering moves AppSec toward harness design, platform constraints, and measurable risk.","findings":3,"id":"jb-htw-berlin-agentic-appsec","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/index.md","modified":"2026-09-23T00:00:00+02:00","published":"2026-07-03T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-07-03","sections":[{"id":"fixing-findings-is-the-new-bottleneck","title":"Fixing Findings Is the New Bottleneck","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#fixing-findings-is-the-new-bottleneck"},{"id":"the-harness-is-the-control-plane","title":"The Harness Is the Control Plane","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#the-harness-is-the-control-plane"},{"id":"shift-security-down-into-the-platform","title":"Shift Security Down into the Platform","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#shift-security-down-into-the-platform"},{"id":"give-risk-an-operational-budget","title":"Give Risk an Operational Budget","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#give-risk-an-operational-budget"},{"id":"the-coding-agent-is-an-attack-surface","title":"The Coding Agent Is an Attack Surface","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#the-coding-agent-is-an-attack-surface"},{"id":"what-i-asked-the-students-to-learn","title":"What I Asked the Students to Learn","url":"https://www.janbrennenstuhl.eu/new-appsec-operating-model/#what-i-asked-the-students-to-learn"}],"series":"agentic-appsec","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/htw-berlin-agentic-appsec/index.md","status":"published","title":"Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering","topics":["agentic-engineering","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/shift-down-appsec/","claim":"Coding agents multiply whatever patterns exist, so AppSec should build security into platform defaults that remove risky decisions, and keep scanning as the fallback.","content_hash":"sha256:b7420d846964374cf3a8f83319e2594b16ea0a056e31cb6e9e03ea53169c98a8","description":"Agentic engineering amplifies architectural entropy at machine speed. The answer is not more security gates but fewer decisions: shift security down into platforms.","findings":3,"id":"jb-appsec-shift-down","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/shift-down-appsec/index.md","modified":"2026-06-14T00:00:00+02:00","published":"2026-06-14T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-06-14","sections":[{"id":"shift-left-distributes-responsibility-shift-down-removes-decisions","title":"Shift-Left Distributes Responsibility. Shift-Down Removes Decisions.","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#shift-left-distributes-responsibility-shift-down-removes-decisions"},{"id":"agentic-engineering-makes-this-urgent","title":"Agentic Engineering Makes This Urgent","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#agentic-engineering-makes-this-urgent"},{"id":"platforms-as-security-architecture","title":"Platforms as Security Architecture","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#platforms-as-security-architecture"},{"id":"appsec-moves-from-enforcement-to-architecture","title":"AppSec Moves from Enforcement to Architecture","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#appsec-moves-from-enforcement-to-architecture"},{"id":"the-paradox-less-freedom-more-productivity","title":"The Paradox: Less Freedom, More Productivity","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#the-paradox-less-freedom-more-productivity"},{"id":"where-this-leaves-appsec-teams","title":"Where This Leaves AppSec Teams","url":"https://www.janbrennenstuhl.eu/shift-down-appsec/#where-this-leaves-appsec-teams"}],"series":"agentic-appsec","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/appsec-shift-down/index.md","status":"published","title":"Shift Down: Why Agentic Engineering Demands Platform-Level Security","topics":["agentic-engineering","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/dependency-updates/","claim":"Automatic dependency updates push compromised packages into builds within hours, so teams should pin exact versions, enforce release-age cooldowns, and upgrade on their own schedule after review.","content_hash":"sha256:8dc6be07346f39a6c12a8010eb32b80d62f8ed5296beabe0ff444303f4511b58","description":"Automatic dependency updates spread compromised packages faster than humans can react. Version pinning, provenance verification, and repository proxies turn blind trust into controlled trust.","findings":3,"id":"jb-automatic-dependency-updates","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/dependency-updates/index.md","modified":"2026-05-17T00:00:00+02:00","published":"2026-05-15T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-05-15","sections":[{"id":"the-trust-problem","title":"The Trust Problem","url":"https://www.janbrennenstuhl.eu/dependency-updates/#the-trust-problem"},{"id":"what-controlled-trust-looks-like","title":"What Controlled Trust Looks Like","url":"https://www.janbrennenstuhl.eu/dependency-updates/#what-controlled-trust-looks-like"},{"id":"pin-versions","title":"Pin Versions","url":"https://www.janbrennenstuhl.eu/dependency-updates/#pin-versions"},{"id":"enforce-release-age-cooldowns","title":"Enforce Release-Age Cooldowns","url":"https://www.janbrennenstuhl.eu/dependency-updates/#enforce-release-age-cooldowns"},{"id":"control-upgrade-cadence","title":"Control Upgrade Cadence","url":"https://www.janbrennenstuhl.eu/dependency-updates/#control-upgrade-cadence"},{"id":"verify-provenance-but-do-not-trust-it-alone","title":"Verify Provenance, But Do Not Trust It Alone","url":"https://www.janbrennenstuhl.eu/dependency-updates/#verify-provenance-but-do-not-trust-it-alone"},{"id":"deploy-repository-proxies","title":"Deploy Repository Proxies","url":"https://www.janbrennenstuhl.eu/dependency-updates/#deploy-repository-proxies"},{"id":"use-reachability-aware-scanning","title":"Use Reachability-Aware Scanning","url":"https://www.janbrennenstuhl.eu/dependency-updates/#use-reachability-aware-scanning"},{"id":"reduce-dependency-surface-area","title":"Reduce Dependency Surface Area","url":"https://www.janbrennenstuhl.eu/dependency-updates/#reduce-dependency-surface-area"},{"id":"controlled-trust-not-blind-trust","title":"Controlled Trust, Not Blind Trust","url":"https://www.janbrennenstuhl.eu/dependency-updates/#controlled-trust-not-blind-trust"}],"series":"agentic-appsec","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/automatic-dependency-updates/index.md","status":"published","title":"Dependency Updates: latest Is Not a Security Strategy","topics":["application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/","claim":"AppSec teams keep up with coding agents by fixing findings inside the agent loop, shipping security tooling to agents, and managing risk budgets together with SRE and platform teams.","content_hash":"sha256:fce94a0db078744ea1ac278ed5366563c0d2f1550b717f70e120d62b529675cb","description":"How AppSec teams can keep up with coding agents: fix findings inside the agent loop, ship security tooling to agents, and manage risk with SRE and platform teams.","findings":3,"id":"jb-appsec-agentic-engineering","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/index.md","modified":"2026-09-24T00:00:00+02:00","published":"2026-05-14T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2026-05-14","sections":[{"id":"findings-pile-up-faster-than-teams-fix-them","title":"Findings Pile Up Faster Than Teams Fix Them","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#findings-pile-up-faster-than-teams-fix-them"},{"id":"move-security-feedback-into-the-agent-loop","title":"Move Security Feedback Into the Agent Loop","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#move-security-feedback-into-the-agent-loop"},{"id":"build-and-ship-security-tooling","title":"Build and Ship Security Tooling","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#build-and-ship-security-tooling"},{"id":"security-skills-and-machine-readable-policy","title":"Security Skills and Machine-Readable Policy","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#security-skills-and-machine-readable-policy"},{"id":"local-scanners-and-review-agents","title":"Local Scanners and Review Agents","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#local-scanners-and-review-agents"},{"id":"sandboxes-and-short-lived-credentials","title":"Sandboxes and Short-Lived Credentials","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#sandboxes-and-short-lived-credentials"},{"id":"threat-modeling-and-offensive-testing","title":"Threat Modeling and Offensive Testing","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#threat-modeling-and-offensive-testing"},{"id":"partner-with-sre-and-platform-teams","title":"Partner With SRE and Platform Teams","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#partner-with-sre-and-platform-teams"},{"id":"where-to-start","title":"Where to Start","url":"https://www.janbrennenstuhl.eu/appsec-agentic-engineering/#where-to-start"}],"series":"agentic-appsec","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/appsec-agentic-engineering/index.md","status":"published","title":"AppSec in the Age of Agentic Engineering","topics":["agentic-engineering","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/european-jamstack/","claim":"A static JAMstack site can run entirely on European providers: Codeberg for code and Forgejo Actions deployment, Bunny CDN for hosting, and Plausible for cookie-free analytics.","content_hash":"sha256:babaaad2b82c25096237ff7929f4888039988afe28342db569cc13ee0e5056ac","description":"Looking for a European alternative to replace Github or Netlify? Don't look further! Learn what EU service providers I use to power my JAMstack.","findings":0,"id":"jb-european-jamstack","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/european-jamstack/index.md","modified":"2026-10-25T00:00:00+02:00","published":"2025-07-06T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2025-07-06","sections":[{"id":"what-is-jamstack","title":"What is JAMstack?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#what-is-jamstack"},{"id":"my-european-jamstack","title":"My European JAMstack","url":"https://www.janbrennenstuhl.eu/european-jamstack/#my-european-jamstack"},{"id":"codeberg-my-new-home-for-code","title":"Codeberg: My New Home for Code","url":"https://www.janbrennenstuhl.eu/european-jamstack/#codeberg-my-new-home-for-code"},{"id":"bunny-cdn-fast-and-european-hosting","title":"Bunny CDN: Fast and European Hosting","url":"https://www.janbrennenstuhl.eu/european-jamstack/#bunny-cdn-fast-and-european-hosting"},{"id":"plausible-analytics-privacy-first-insights","title":"Plausible Analytics: Privacy-First Insights","url":"https://www.janbrennenstuhl.eu/european-jamstack/#plausible-analytics-privacy-first-insights"},{"id":"jamstack-migration--service-responsibilities","title":"JAMstack Migration \u0026 Service Responsibilities","url":"https://www.janbrennenstuhl.eu/european-jamstack/#jamstack-migration--service-responsibilities"},{"id":"faq","title":"FAQ","url":"https://www.janbrennenstuhl.eu/european-jamstack/#faq"},{"id":"why-is-it-important-to-switch-to-european-alternatives-for-personal-projects-even-if-they-dont-handle-highly-sensitive-data","title":"Why is it important to switch to European alternatives for personal projects, even if they don’t handle highly sensitive data?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#why-is-it-important-to-switch-to-european-alternatives-for-personal-projects-even-if-they-dont-handle-highly-sensitive-data"},{"id":"are-there-any-performance-trade-offs-when-switching-from-us-based-providers-like-netlify-to-european-alternatives","title":"Are there any performance trade-offs when switching from US-based providers like Netlify to European alternatives?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#are-there-any-performance-trade-offs-when-switching-from-us-based-providers-like-netlify-to-european-alternatives"},{"id":"what-are-potential-challenges-when-migrating-existing-jamstack-projects-from-netlifys-build-process-to-codebergs-forgejo-actions","title":"What are potential challenges when migrating existing JAMstack projects from Netlify’s build process to Codeberg’s Forgejo Actions?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#what-are-potential-challenges-when-migrating-existing-jamstack-projects-from-netlifys-build-process-to-codebergs-forgejo-actions"},{"id":"what-other-european-jamstack-services-or-categories-should-be-considered-for-a-fully-european-setup","title":"What other European JAMstack services or categories should be considered for a fully European setup?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#what-other-european-jamstack-services-or-categories-should-be-considered-for-a-fully-european-setup"},{"id":"what-are-the-main-benefits-of-open-source-principles-for-users-of-providers-like-codeberg-compared-to-proprietary-platforms","title":"What are the main benefits of “open-source principles” for users of providers like Codeberg, compared to proprietary platforms?","url":"https://www.janbrennenstuhl.eu/european-jamstack/#what-are-the-main-benefits-of-open-source-principles-for-users-of-providers-like-codeberg-compared-to-proprietary-platforms"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/european-jamstack/index.md","status":"published","title":"Goodbye Big Tech: My European JAMstack Migration","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/bunny-shield-review/","claim":"Bunny Shield is easy to set up and has reasonable default rules, but it needs bot allowlisting, traceable WAF event logs and a fix for blocked Let's Encrypt HTTP-01 challenges.","content_hash":"sha256:b0fd570b03f43e6b20ae00dde1e872db092a35b1ff6e96149ee929487d50f3ca","description":"I tested Bunny Shield by Bunny.net – Three things that need attention: False positives, bot management \u0026 observability.","findings":0,"id":"jb-bunny-shield-review","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/bunny-shield-review/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2025-06-07T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2025-06-07","sections":[{"id":"what-bunny-shield-gets-right","title":"What Bunny Shield Gets Right","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#what-bunny-shield-gets-right"},{"id":"initial-user-experience--setup-simplicity","title":"Initial User Experience \u0026 Setup Simplicity","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#initial-user-experience--setup-simplicity"},{"id":"default-security-coverage","title":"Default Security Coverage","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#default-security-coverage"},{"id":"what-bunny-shield-needs-to-improve","title":"What Bunny Shield Needs to Improve","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#what-bunny-shield-needs-to-improve"},{"id":"certificate-renewal-blocked-by-waf","title":"Certificate Renewal Blocked by WAF","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#certificate-renewal-blocked-by-waf"},{"id":"no-bot-allowlisting-for-good-bots-like-ahrefs-or-semrush","title":"No Bot Allowlisting for Good Bots like Ahrefs or Semrush","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#no-bot-allowlisting-for-good-bots-like-ahrefs-or-semrush"},{"id":"limited-logging-and-visibility-into-waf-events","title":"Limited Logging and Visibility into WAF Events","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#limited-logging-and-visibility-into-waf-events"},{"id":"missing-waf-error-code-lookup-tool","title":"Missing WAF Error Code Lookup Tool","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#missing-waf-error-code-lookup-tool"},{"id":"final-thoughts-promising-foundations-but-still-in-beta","title":"Final Thoughts: Promising Foundations, But Still in Beta","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#final-thoughts-promising-foundations-but-still-in-beta"},{"id":"got-feedback-or-similar-experiences","title":"Got Feedback or Similar Experiences?","url":"https://www.janbrennenstuhl.eu/bunny-shield-review/#got-feedback-or-similar-experiences"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/bunny-shield-review/index.md","status":"published","title":"Bunny Shield Review: 3 Things Need Improvement","topics":["application-security","engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/","claim":"With Bunny DNS you can redirect a root domain to its www subdomain using a redirect (RDR) record, or a pull zone or CNAME record combined with a 301 Edge Rule.","content_hash":"sha256:cc318bec2016b3063309a67b76207fb196f046e657999585aa2f18cf2aa4bbf9","description":"Bunny.net: Learn how to redirect a root domain to its www subdomain using Bunny DNS and Bunny CDN Edge Rules.","findings":0,"id":"jb-bunny-root-redirect","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2025-04-22T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2025-04-22","sections":[{"id":"option-1-redirect-record-rdr","title":"Option 1: Redirect Record (RDR)","url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/#option-1-redirect-record-rdr"},{"id":"option-2-pull-zone-record-pz","title":"Option 2: Pull Zone Record (PZ)","url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/#option-2-pull-zone-record-pz"},{"id":"option-3-canonical-name-record-cname","title":"Option 3: Canonical Name Record (CNAME)","url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/#option-3-canonical-name-record-cname"},{"id":"dedicated-edge-rule","title":"Dedicated Edge Rule","url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/#dedicated-edge-rule"},{"id":"summary","title":"Summary","url":"https://www.janbrennenstuhl.eu/bunny-cdn-domain-redirect/#summary"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/bunny-root-redirect/index.md","status":"published","title":"Bunny CDN: How to redirect Root Domain to Subdomain","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/jwa/","claim":"JWA defines the algorithms behind every JWT: HMAC suits setups with one issuer and verifier, while RSA and ECDSA let OpenID Connect clients verify tokens without central introspection.","content_hash":"sha256:29545a32944701836a664f7fb2cae7ccbb8acb955a515463dc63d160b7f08486","description":"JSON Web Algorithms (JWA) power all JWT use cases. Learn how to decode JWA short names, what algorithms there are and why JWA matters for OpenID Connect.","findings":0,"id":"jb-jwa","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/jwa/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2023-06-08T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-06-08","sections":[{"id":"definition-of-jwa","title":"Definition of JWA","url":"https://www.janbrennenstuhl.eu/jwa/#definition-of-jwa"},{"id":"anatomy-of-json-web-algorithms","title":"Anatomy of JSON Web Algorithms","url":"https://www.janbrennenstuhl.eu/jwa/#anatomy-of-json-web-algorithms"},{"id":"different-types-of-json-web-algorithms","title":"Different Types of JSON Web Algorithms","url":"https://www.janbrennenstuhl.eu/jwa/#different-types-of-json-web-algorithms"},{"id":"understanding-the-symmetric-key-algorithms","title":"Understanding the Symmetric Key Algorithms","url":"https://www.janbrennenstuhl.eu/jwa/#understanding-the-symmetric-key-algorithms"},{"id":"delving-into-asymmetric-key-algorithms","title":"Delving into Asymmetric Key Algorithms","url":"https://www.janbrennenstuhl.eu/jwa/#delving-into-asymmetric-key-algorithms"},{"id":"practical-applications-of-jwa","title":"Practical Applications of JWA","url":"https://www.janbrennenstuhl.eu/jwa/#practical-applications-of-jwa"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/jwa/#conclusion"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/jwa/index.md","status":"published","title":"What is JWA? A Deep Dive into JSON Web Algorithms","topics":["tokens-jwt"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/jwks/","claim":"A JSON Web Key Set lets an identity provider publish its public keys at one URL, so clients can verify JWT signatures locally and the issuer can rotate keys without redistributing them.","content_hash":"sha256:d16673b7fdeb2b3702af9d66473691076ac6d24082669152bbab0302c8a474d8","description":"Demystify JWKS with this simplified guide. Learn about JSON Web Key Sets, their purpose, and how to implement them successfully. Master JWKS now!","findings":0,"id":"jb-jwks","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/jwks/index.md","modified":"2023-06-02T00:00:00+02:00","published":"2023-06-02T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-06-02","sections":[{"id":"tldr","title":"TL;DR","url":"https://www.janbrennenstuhl.eu/jwks/#tldr"},{"id":"technical-specifications-of-jwk-and-jwks","title":"Technical Specifications of JWK and JWKS","url":"https://www.janbrennenstuhl.eu/jwks/#technical-specifications-of-jwk-and-jwks"},{"id":"what-is-json-web-key-jwk","title":"What is JSON Web Key (JWK)?","url":"https://www.janbrennenstuhl.eu/jwks/#what-is-json-web-key-jwk"},{"id":"what-is-json-web-key-set-jwks","title":"What is JSON Web Key Set (JWKS)?","url":"https://www.janbrennenstuhl.eu/jwks/#what-is-json-web-key-set-jwks"},{"id":"locate-json-web-key-sets","title":"Locate JSON Web Key Sets","url":"https://www.janbrennenstuhl.eu/jwks/#locate-json-web-key-sets"},{"id":"benefits-of-using-jwks","title":"Benefits of Using JWKS","url":"https://www.janbrennenstuhl.eu/jwks/#benefits-of-using-jwks"},{"id":"easy-management-of-keys-with-jwk-sets","title":"Easy Management of Keys with JWK Sets","url":"https://www.janbrennenstuhl.eu/jwks/#easy-management-of-keys-with-jwk-sets"},{"id":"simplified-key-rotation-process-using-jwks","title":"Simplified Key Rotation Process Using JWKs","url":"https://www.janbrennenstuhl.eu/jwks/#simplified-key-rotation-process-using-jwks"},{"id":"compatibility-with-various-protocols-and-applications","title":"Compatibility with Various Protocols and Applications","url":"https://www.janbrennenstuhl.eu/jwks/#compatibility-with-various-protocols-and-applications"},{"id":"best-practices--security-considerations","title":"Best Practices \u0026 Security Considerations","url":"https://www.janbrennenstuhl.eu/jwks/#best-practices--security-considerations"},{"id":"use-transport-layer-security","title":"Use Transport Layer Security","url":"https://www.janbrennenstuhl.eu/jwks/#use-transport-layer-security"},{"id":"make-sure-jwks-is-correct-and-current","title":"Make sure JWKS is correct and current","url":"https://www.janbrennenstuhl.eu/jwks/#make-sure-jwks-is-correct-and-current"},{"id":"validate-the-signatures-of-incoming-jwts-using-jwks","title":"Validate the signatures of incoming JWTs using JWKs","url":"https://www.janbrennenstuhl.eu/jwks/#validate-the-signatures-of-incoming-jwts-using-jwks"},{"id":"consider-rotating-your-jwks-keys-periodically","title":"Consider rotating your JWKS keys periodically","url":"https://www.janbrennenstuhl.eu/jwks/#consider-rotating-your-jwks-keys-periodically"},{"id":"conclusion-the-importance-of-using-json-web-key-sets","title":"Conclusion: The Importance of Using JSON Web Key Sets","url":"https://www.janbrennenstuhl.eu/jwks/#conclusion-the-importance-of-using-json-web-key-sets"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/jwks/index.md","status":"published","title":"Mastering JWKS: JSON Web Key Sets Explained","topics":["tokens-jwt","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/jwe/","claim":"JWE keeps a JWT's payload confidential through authenticated encryption, but its security depends on careful algorithm choice, key management, token expiry and keeping sensitive data out of headers.","content_hash":"sha256:723818e0ec37a360f28a432a767e9145865df5a7407210d3cb494b366e59e23a","description":"Explore the world of JWE token with this in-depth guide. Gain understanding of JSON Web Encryption standards.","findings":0,"id":"jb-jwe-token","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/jwe/index.md","modified":"2025-06-15T00:00:00+02:00","published":"2023-05-29T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-29","sections":[{"id":"tldr","title":"TL;DR","url":"https://www.janbrennenstuhl.eu/jwe/#tldr"},{"id":"json-web-encryption-jwe-token-a-comprehensive-guide","title":"JSON Web Encryption (JWE) Token: A Comprehensive Guide","url":"https://www.janbrennenstuhl.eu/jwe/#json-web-encryption-jwe-token-a-comprehensive-guide"},{"id":"the-structure-of-an-encrypted-jwt","title":"The Structure of an Encrypted JWT","url":"https://www.janbrennenstuhl.eu/jwe/#the-structure-of-an-encrypted-jwt"},{"id":"support-for-symmetric-and-asymmetric-encryption-algorithms","title":"Support for Symmetric and Asymmetric Encryption Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#support-for-symmetric-and-asymmetric-encryption-algorithms"},{"id":"nested-jwts","title":"Nested JWTs","url":"https://www.janbrennenstuhl.eu/jwe/#nested-jwts"},{"id":"working-with-different-jwe-algorithms","title":"Working with Different JWE Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#working-with-different-jwe-algorithms"},{"id":"jwe-with-aes-algorithms","title":"JWE with AES Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-with-aes-algorithms"},{"id":"jwe-with-rsa-algorithms","title":"JWE with RSA Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-with-rsa-algorithms"},{"id":"jwe-with-elliptic-curve-algorithms","title":"JWE with Elliptic Curve Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-with-elliptic-curve-algorithms"},{"id":"authenticated-encryption-algorithms","title":"Authenticated Encryption Algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#authenticated-encryption-algorithms"},{"id":"jwe-token-generation-process","title":"JWE Token Generation Process","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-token-generation-process"},{"id":"encryption-algorithm-choosing-the-right-one-for-your-needs","title":"Encryption Algorithm: Choosing the Right One for Your Needs","url":"https://www.janbrennenstuhl.eu/jwe/#encryption-algorithm-choosing-the-right-one-for-your-needs"},{"id":"generating-keys-private-key-vs-secret-key","title":"Generating Keys: Private Key vs Secret Key","url":"https://www.janbrennenstuhl.eu/jwe/#generating-keys-private-key-vs-secret-key"},{"id":"complete-jose-header","title":"Complete JOSE Header","url":"https://www.janbrennenstuhl.eu/jwe/#complete-jose-header"},{"id":"encryption--serialization-creating-valid-jwe-tokens","title":"Encryption \u0026 Serialization: Creating Valid JWE Tokens","url":"https://www.janbrennenstuhl.eu/jwe/#encryption--serialization-creating-valid-jwe-tokens"},{"id":"jwe-token-decryption-process","title":"JWE Token Decryption Process","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-token-decryption-process"},{"id":"decoding-the-jwe-compact-serialization","title":"Decoding the JWE Compact Serialization","url":"https://www.janbrennenstuhl.eu/jwe/#decoding-the-jwe-compact-serialization"},{"id":"key-decryption","title":"Key Decryption","url":"https://www.janbrennenstuhl.eu/jwe/#key-decryption"},{"id":"payload-decryption","title":"Payload Decryption","url":"https://www.janbrennenstuhl.eu/jwe/#payload-decryption"},{"id":"security-considerations","title":"Security Considerations","url":"https://www.janbrennenstuhl.eu/jwe/#security-considerations"},{"id":"authentication-tag-and-additional-authenticated-data","title":"Authentication Tag and Additional Authenticated Data","url":"https://www.janbrennenstuhl.eu/jwe/#authentication-tag-and-additional-authenticated-data"},{"id":"leaky-headers","title":"Leaky Headers","url":"https://www.janbrennenstuhl.eu/jwe/#leaky-headers"},{"id":"key-management-and-token-expiry","title":"Key Management and Token Expiry","url":"https://www.janbrennenstuhl.eu/jwe/#key-management-and-token-expiry"},{"id":"weak-algorithms","title":"Weak algorithms","url":"https://www.janbrennenstuhl.eu/jwe/#weak-algorithms"},{"id":"comparison-of-jwe-and-other-json-security-standards","title":"Comparison of JWE and Other JSON Security Standards","url":"https://www.janbrennenstuhl.eu/jwe/#comparison-of-jwe-and-other-json-security-standards"},{"id":"jwe-vs-jwt","title":"JWE vs JWT","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-vs-jwt"},{"id":"jwe-vs-jws-json-web-signature","title":"JWE vs JWS (JSON Web Signature)","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-vs-jws-json-web-signature"},{"id":"jwe-vs-jwk-json-web-key","title":"JWE vs JWK (JSON Web Key)","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-vs-jwk-json-web-key"},{"id":"practical-applications-of-jwe-tokens","title":"Practical Applications of JWE Tokens","url":"https://www.janbrennenstuhl.eu/jwe/#practical-applications-of-jwe-tokens"},{"id":"bearer-token-a-powerful-authentication-and-authorization-tool","title":"Bearer Token: A Powerful Authentication and Authorization Tool","url":"https://www.janbrennenstuhl.eu/jwe/#bearer-token-a-powerful-authentication-and-authorization-tool"},{"id":"jwe-in-oauth2-and-oidc","title":"JWE in OAuth2 and OIDC","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-in-oauth2-and-oidc"},{"id":"jwe-for-data-at-rest","title":"JWE for Data at Rest","url":"https://www.janbrennenstuhl.eu/jwe/#jwe-for-data-at-rest"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/jwe/#conclusion"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/jwe/#frequently-asked-questions-faqs"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/jwe-token/index.md","status":"published","title":"JSON Web Encryption: Exploring JWE Token","topics":["tokens-jwt","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/","claim":"OAuth 2.0 is an authorization framework for delegated access and JWT is a token format, so the two complement each other, and OpenID Connect combines them.","content_hash":"sha256:6a827db4214399bed9765711705583cb909020e461372dfa18191b843561df53","description":"Learn the key differences between JWT and OAuth 2.0 from our expert guide on JWT vs OAuth. Understand which one to choose for authentication.","findings":0,"id":"jb-jwt-vs-oauth","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/index.md","modified":"2023-05-28T00:00:00+02:00","published":"2023-05-24T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-24","sections":[{"id":"tldr","title":"TL;DR","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#tldr"},{"id":"introduction-to-jwt-vs-oauth-20","title":"Introduction to JWT vs OAuth 2.0","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#introduction-to-jwt-vs-oauth-20"},{"id":"what-is-oauth2","title":"What is OAuth2?","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#what-is-oauth2"},{"id":"what-is-jwt","title":"What is JWT?","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#what-is-jwt"},{"id":"when-to-use-oauth-20-vs-when-to-use-jwt","title":"When to Use OAuth 2.0 vs When to Use JWT","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#when-to-use-oauth-20-vs-when-to-use-jwt"},{"id":"combining-oauth-20-and-jwt-how-to-use-them-together","title":"Combining OAuth 2.0 and JWT: How to Use Them Together","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#combining-oauth-20-and-jwt-how-to-use-them-together"},{"id":"jwt-as-bearer-token","title":"JWT as Bearer Token","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#jwt-as-bearer-token"},{"id":"advantages-of-using-jwt-with-oauth-20","title":"Advantages of Using JWT with OAuth 2.0","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#advantages-of-using-jwt-with-oauth-20"},{"id":"which-bearer-token-format-is-right-for-you","title":"Which Bearer Token Format is Right for You?","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#which-bearer-token-format-is-right-for-you"},{"id":"jwt--oauth2--openid-connect-oidc","title":"JWT + OAuth2 = OpenID Connect (OIDC)","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#jwt--oauth2--openid-connect-oidc"},{"id":"conclusion-choosing-between-jwt-and-oauth2","title":"Conclusion: Choosing Between JWT and OAuth2","url":"https://www.janbrennenstuhl.eu/jwt-vs-oauth/#conclusion-choosing-between-jwt-and-oauth2"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/jwt-vs-oauth/index.md","status":"published","title":"JWT vs OAuth 2.0: Understanding the Key Differences","topics":["tokens-jwt","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/whaling-awareness/","claim":"Whaling defense combines regular awareness training and simulations with SPF, DKIM and DMARC, two-factor email login, and payment policies that require out-of-band verification and two sign-offs.","content_hash":"sha256:cefead6991b79446f6f66b44d6a4acc3d1a1900a84331766555f69432a694769","description":"Protect your business from whaling cyber attacks with our comprehensive training and prevention tips. Learn what is whaling cyber awareness today.","findings":0,"id":"jb-whaling-awareness","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/whaling-awareness/index.md","modified":"2025-03-25T00:00:00+01:00","published":"2023-05-23T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-23","sections":[{"id":"what-is-whaling-cyber-awareness","title":"What is Whaling Cyber Awareness?","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#what-is-whaling-cyber-awareness"},{"id":"security-awareness-why-it-matters","title":"Security Awareness: Why It Matters","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#security-awareness-why-it-matters"},{"id":"technologies-and-strategies-for-whaling-prevention","title":"Technologies and Strategies for Whaling Prevention","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#technologies-and-strategies-for-whaling-prevention"},{"id":"defensive-technologies-anti-spoofing-secure-email-gateways-and-ai-based-solutions","title":"Defensive Technologies: Anti-Spoofing, Secure Email Gateways, and AI-based Solutions","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#defensive-technologies-anti-spoofing-secure-email-gateways-and-ai-based-solutions"},{"id":"proactive-measures-two-factor-authentication-secure-communication-channels","title":"Proactive Measures: Two-Factor Authentication, Secure Communication Channels","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#proactive-measures-two-factor-authentication-secure-communication-channels"},{"id":"incident-response-planning-preparation-for-whaling-attacks","title":"Incident Response Planning: Preparation for Whaling Attacks","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#incident-response-planning-preparation-for-whaling-attacks"},{"id":"make-dmarc-a-part-of-your-whaling-cyber-awareness-agenda","title":"Make DMARC a part of your Whaling Cyber Awareness Agenda","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#make-dmarc-a-part-of-your-whaling-cyber-awareness-agenda"},{"id":"robust-compliance-policies","title":"Robust Compliance Policies","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#robust-compliance-policies"},{"id":"defense-strategies-for-individuals","title":"Defense Strategies for Individuals","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#defense-strategies-for-individuals"},{"id":"the-future-of-whaling-and-cyber-awareness","title":"The Future of Whaling and Cyber Awareness","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#the-future-of-whaling-and-cyber-awareness"},{"id":"predicting-future-trends-in-whaling-the-changing-landscape","title":"Predicting Future Trends in Whaling: The Changing Landscape","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#predicting-future-trends-in-whaling-the-changing-landscape"},{"id":"the-role-of-ai-and-machine-learning-in-whaling-defense","title":"The Role of AI and Machine Learning in Whaling Defense","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#the-role-of-ai-and-machine-learning-in-whaling-defense"},{"id":"a-machine-learning-approach-to-phishing-detection-and-defense","title":"A Machine-Learning Approach to Phishing Detection and Defense","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#a-machine-learning-approach-to-phishing-detection-and-defense"},{"id":"the-importance-of-ongoing-cyber-awareness-training-and-education","title":"The Importance of Ongoing Cyber Awareness Training and Education","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#the-importance-of-ongoing-cyber-awareness-training-and-education"},{"id":"ai-driven-cybersecurity","title":"AI-driven Cybersecurity","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#ai-driven-cybersecurity"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/whaling-awareness/#frequently-asked-questions-faqs"}],"series":"whaling","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/whaling-awareness/index.md","status":"published","title":"What is Whaling Cyber Awareness? Prevention Tips \u0026 Training","topics":["application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/whaling-phishing/","claim":"Whaling targets executives with researched, personalized phishing that technical controls alone do not stop, so organizations need awareness training and must verify unusual payment requests through a separate channel.","content_hash":"sha256:50332ea3e0a1d1dfc39c6d0a5cd2166857cbac30deb87d9600a0f6721b94363e","description":"Learn the definition of whaling phishing and effective prevention strategies. Stay protected from sophisticated cyber attacks with our expert guide.","findings":0,"id":"jb-whaling","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/whaling-phishing/index.md","modified":"2023-06-03T00:00:00+02:00","published":"2023-05-18T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-18","sections":[{"id":"spear-phishing-vs-whaling-attacks-in-cybersecurity","title":"Spear Phishing vs Whaling Attacks in Cybersecurity","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#spear-phishing-vs-whaling-attacks-in-cybersecurity"},{"id":"whale-phishing-a-personalized-approach-to-spear-phishing","title":"Whale Phishing: A Personalized Approach to Spear Phishing","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#whale-phishing-a-personalized-approach-to-spear-phishing"},{"id":"the-risks-of-spear-phishing-attacks","title":"The Risks of Spear Phishing Attacks","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#the-risks-of-spear-phishing-attacks"},{"id":"how-whaling-works","title":"How Whaling Works","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#how-whaling-works"},{"id":"targeting-the-top","title":"Targeting the Top","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#targeting-the-top"},{"id":"social-engineering-tactics","title":"Social Engineering Tactics","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#social-engineering-tactics"},{"id":"impersonation","title":"Impersonation","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#impersonation"},{"id":"whaling-attack-examples","title":"Whaling Attack Examples","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#whaling-attack-examples"},{"id":"ceo-fraud","title":"CEO Fraud","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#ceo-fraud"},{"id":"high-profile-whaling-attacks","title":"High-Profile Whaling Attacks","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#high-profile-whaling-attacks"},{"id":"strategies-for-preventing-whaling-cyber-attacks","title":"Strategies for Preventing Whaling Cyber Attacks","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#strategies-for-preventing-whaling-cyber-attacks"},{"id":"implement-employee-training-programs","title":"Implement Employee Training Programs","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#implement-employee-training-programs"},{"id":"establish-best-practices-for-email-communication","title":"Establish Best Practices for Email Communication","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#establish-best-practices-for-email-communication"},{"id":"profile-target-audiences","title":"Profile Target Audiences","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#profile-target-audiences"},{"id":"protecting-against-whaling-phishing-attacks","title":"Protecting Against Whaling Phishing Attacks","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#protecting-against-whaling-phishing-attacks"},{"id":"potential-impact-of-whaling-phishing-on-organizations","title":"Potential Impact of Whaling Phishing on Organizations","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#potential-impact-of-whaling-phishing-on-organizations"},{"id":"financial-losses","title":"Financial Losses","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#financial-losses"},{"id":"reputational-damage","title":"Reputational Damage","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#reputational-damage"},{"id":"compromised-sensitive-data","title":"Compromised Sensitive Data","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#compromised-sensitive-data"},{"id":"conclusion-understanding-the-risks-of-whaling-phishing-attacks","title":"Conclusion: Understanding the Risks of Whaling Phishing Attacks","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#conclusion-understanding-the-risks-of-whaling-phishing-attacks"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/whaling-phishing/#frequently-asked-questions-faqs"}],"series":"whaling","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/whaling/index.md","status":"published","title":"Whaling Phishing: Definition and Prevention Strategies","topics":["application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/","claim":"Testing 6 certified OpenID providers and 8 relying parties against 18 known attacks uncovered 12 implementation flaws.","content_hash":"sha256:57b9151420c3c0eb18d520f0eb11d26422d1482ed15b49e7e0e663e7ab0a34a4","description":"The attacks that work against OpenID Connect clients and providers, documented by Ruhr-University Bochum, and the checks that prevent them.","findings":3,"id":"jb-research-oidc-security","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-05-15T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#the-studies-in-detail"},{"id":"security-analysis-of-real-life-openid-connect-implementations","title":"Security Analysis of Real-Life OpenID Connect Implementations","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#security-analysis-of-real-life-openid-connect-implementations"},{"id":"openid-connect-security-considerations","title":"OpenID Connect Security Considerations","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#openid-connect-security-considerations"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/oidc/oidc-security/index.md","status":"published","title":"Where do OpenID Connect implementations break?","topics":["identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/step-up-authentication/","claim":"Step-up authentication asks for extra factors only for sensitive actions, and OpenID Connect relying parties can request it from the identity provider with the max_age and acr_values parameters.","content_hash":"sha256:f5a15c0bdb01e36d50a405d2ea1fc67ace35a8f40a0d976a299bae802812b91e","description":"Delve into this guide on Step-Up Authentication using OpenID Connect. Learn to balance security with friction \u0026 how to elevate authentication levels.","findings":0,"id":"jb-stepup-authentication","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/step-up-authentication/index.md","modified":"2023-06-03T00:00:00+02:00","published":"2023-05-14T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-14","sections":[{"id":"what-is-step-up-authentication","title":"What is Step-Up Authentication?","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#what-is-step-up-authentication"},{"id":"the-rationale-behind-step-up-authentication","title":"The Rationale Behind Step-Up Authentication","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#the-rationale-behind-step-up-authentication"},{"id":"step-up-authentication-vs-single-factor-authentication","title":"Step-Up Authentication vs Single-Factor Authentication","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#step-up-authentication-vs-single-factor-authentication"},{"id":"step-up-authentication-vs-multi-factor-authentication","title":"Step-Up Authentication vs Multi-Factor Authentication","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#step-up-authentication-vs-multi-factor-authentication"},{"id":"step-up-authentication-vs-adaptive-authentication","title":"Step-Up Authentication vs Adaptive Authentication","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#step-up-authentication-vs-adaptive-authentication"},{"id":"how-step-up-authentication-works","title":"How Step-Up Authentication Works","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#how-step-up-authentication-works"},{"id":"implementing-step-up-authentication","title":"Implementing Step-Up Authentication","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#implementing-step-up-authentication"},{"id":"step-up-authentication-with-openid-connect","title":"Step-up Authentication with OpenID Connect","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#step-up-authentication-with-openid-connect"},{"id":"forced-re-authentication-methods","title":"Forced Re-Authentication Methods","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#forced-re-authentication-methods"},{"id":"authentication-context-class-reference-acr","title":"Authentication Context Class Reference (ACR)","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#authentication-context-class-reference-acr"},{"id":"authentication-level-elevation","title":"Authentication Level Elevation","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#authentication-level-elevation"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#conclusion"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#frequently-asked-questions-faqs"},{"id":"what-are-the-minimum-requirements-to-implement-step-up-authentication","title":"What are the minimum requirements to implement Step-Up Authentication?","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#what-are-the-minimum-requirements-to-implement-step-up-authentication"},{"id":"how-does-step-up-authentication-improve-user-experience","title":"How does Step-Up Authentication improve user experience?","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#how-does-step-up-authentication-improve-user-experience"},{"id":"how-can-step-up-authentication-prevent-data-breaches","title":"How can Step-Up Authentication prevent data breaches?","url":"https://www.janbrennenstuhl.eu/step-up-authentication/#how-can-step-up-authentication-prevent-data-breaches"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/stepup-authentication/index.md","status":"published","title":"Step-Up Authentication: Elevating Security with OpenID Connect (OIDC)","topics":["identity-authentication","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/password-spraying/","claim":"Password spraying tries a few common passwords across many accounts to avoid lockouts, so defenders need failed-login monitoring, bot management and MFA, and passwordless login removes the target entirely.","content_hash":"sha256:bb0e68d0398c3af5b4d28a1f0d3e219616101baa9144c06f7fd759e56d211d07","description":"Learn about password spraying, a common attack technique that hackers use to compromise accounts. Discover how it works \u0026 essential prevention strategies.","findings":0,"id":"jb-password-spraying","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/password-spraying/index.md","modified":"2023-05-11T00:00:00+02:00","published":"2023-05-11T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-11","sections":[{"id":"introduction-to-password-attacks","title":"Introduction to Password Attacks","url":"https://www.janbrennenstuhl.eu/password-spraying/#introduction-to-password-attacks"},{"id":"what-is-password-spraying","title":"What is Password Spraying?","url":"https://www.janbrennenstuhl.eu/password-spraying/#what-is-password-spraying"},{"id":"the-motivation-behind-password-spraying-attacks","title":"The motivation behind password spraying attacks","url":"https://www.janbrennenstuhl.eu/password-spraying/#the-motivation-behind-password-spraying-attacks"},{"id":"how-password-spraying-works","title":"How Password Spraying Works","url":"https://www.janbrennenstuhl.eu/password-spraying/#how-password-spraying-works"},{"id":"targeting-multiple-accounts","title":"Targeting Multiple Accounts","url":"https://www.janbrennenstuhl.eu/password-spraying/#targeting-multiple-accounts"},{"id":"common-passwords--dictionary-attack","title":"Common Passwords \u0026 Dictionary Attack","url":"https://www.janbrennenstuhl.eu/password-spraying/#common-passwords--dictionary-attack"},{"id":"the-use-of-bots--automation-in-password-spraying","title":"The Use of Bots \u0026 Automation in Password Spraying","url":"https://www.janbrennenstuhl.eu/password-spraying/#the-use-of-bots--automation-in-password-spraying"},{"id":"password-spraying-vs-brute-force-attack","title":"Password Spraying vs Brute-Force Attack","url":"https://www.janbrennenstuhl.eu/password-spraying/#password-spraying-vs-brute-force-attack"},{"id":"password-spraying-vs-credential-stuffing","title":"Password Spraying vs Credential Stuffing","url":"https://www.janbrennenstuhl.eu/password-spraying/#password-spraying-vs-credential-stuffing"},{"id":"password-spraying-vs-dictionary-attack","title":"Password Spraying vs Dictionary Attack","url":"https://www.janbrennenstuhl.eu/password-spraying/#password-spraying-vs-dictionary-attack"},{"id":"real-world-examples-of-password-spraying","title":"Real-World Examples of Password Spraying","url":"https://www.janbrennenstuhl.eu/password-spraying/#real-world-examples-of-password-spraying"},{"id":"how-a-password-spraying-attack-affects-your-customers","title":"How a Password Spraying Attack Affects Your Customers","url":"https://www.janbrennenstuhl.eu/password-spraying/#how-a-password-spraying-attack-affects-your-customers"},{"id":"detecting-password-spraying-attacks","title":"Detecting password spraying attacks ","url":"https://www.janbrennenstuhl.eu/password-spraying/#detecting-password-spraying-attacks"},{"id":"sudden-spike-in-failed-login-attempts","title":"Sudden Spike in Failed Login Attempts","url":"https://www.janbrennenstuhl.eu/password-spraying/#sudden-spike-in-failed-login-attempts"},{"id":"unusual-account-activity","title":"Unusual Account Activity","url":"https://www.janbrennenstuhl.eu/password-spraying/#unusual-account-activity"},{"id":"password-spraying-prevention","title":"Password spraying prevention","url":"https://www.janbrennenstuhl.eu/password-spraying/#password-spraying-prevention"},{"id":"ip-blocking--geo-blocking","title":"IP-Blocking \u0026 Geo-Blocking","url":"https://www.janbrennenstuhl.eu/password-spraying/#ip-blocking--geo-blocking"},{"id":"bot-management","title":"Bot Management","url":"https://www.janbrennenstuhl.eu/password-spraying/#bot-management"},{"id":"intermediary-challenges","title":"Intermediary Challenges","url":"https://www.janbrennenstuhl.eu/password-spraying/#intermediary-challenges"},{"id":"strong-password-policies-and-best-practices","title":"Strong Password Policies and Best Practices","url":"https://www.janbrennenstuhl.eu/password-spraying/#strong-password-policies-and-best-practices"},{"id":"passwordless-authentication","title":"Passwordless Authentication","url":"https://www.janbrennenstuhl.eu/password-spraying/#passwordless-authentication"},{"id":"enable-multi-factor-authentication-mfa","title":"Enable Multi-factor Authentication (MFA)","url":"https://www.janbrennenstuhl.eu/password-spraying/#enable-multi-factor-authentication-mfa"},{"id":"the-ongoing-battle-against-password-attacks","title":"The Ongoing Battle Against Password Attacks","url":"https://www.janbrennenstuhl.eu/password-spraying/#the-ongoing-battle-against-password-attacks"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/password-spraying/#frequently-asked-questions-faqs"},{"id":"can-password-spraying-be-easily-detected","title":"Can password spraying be easily detected?","url":"https://www.janbrennenstuhl.eu/password-spraying/#can-password-spraying-be-easily-detected"},{"id":"how-can-i-protect-my-personal-accounts-from-password-spraying-attacks","title":"How can I protect my personal accounts from password-spraying attacks?","url":"https://www.janbrennenstuhl.eu/password-spraying/#how-can-i-protect-my-personal-accounts-from-password-spraying-attacks"},{"id":"are-there-any-tools-available-to-help-detect-and-prevent-password-spraying","title":"Are there any tools available to help detect and prevent password spraying?","url":"https://www.janbrennenstuhl.eu/password-spraying/#are-there-any-tools-available-to-help-detect-and-prevent-password-spraying"},{"id":"what-should-i-do-if-i-suspect-password-spraying-compromised-my-account","title":"What should I do if I suspect password spraying compromised my account?","url":"https://www.janbrennenstuhl.eu/password-spraying/#what-should-i-do-if-i-suspect-password-spraying-compromised-my-account"},{"id":"is-it-possible-to-prevent-a-password-spraying-attack","title":"Is it Possible to Prevent a Password Spraying Attack?","url":"https://www.janbrennenstuhl.eu/password-spraying/#is-it-possible-to-prevent-a-password-spraying-attack"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/password-spraying/index.md","status":"published","title":"Password Attack Guide: What is Password Spraying?","topics":["passwords","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/fido-passkeys/","claim":"Passkeys resist phishing but replace knowledge with possession and tie users to devices and Big Tech vendors, so most people should wait for the ecosystem to mature before going passkey-only.","content_hash":"sha256:aef5cf7dec32625792c7d814395c1dd2bc25d2976eada6f8690deb2143cfdf60","description":"Critical notes on passwordless authentication with FIDO2 Passkeys. Potential risks and challenges of passkey concepts \u0026 implications for users.","findings":0,"id":"jb-passkeys-controversy","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/fido-passkeys/index.md","modified":"2025-06-09T00:00:00+02:00","published":"2023-05-08T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-08","sections":[{"id":"introduction-to-fido2--passkeys","title":"Introduction to FIDO2 \u0026 Passkeys","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#introduction-to-fido2--passkeys"},{"id":"phishing-resistant-passwordless-authentication","title":"Phishing-resistant Passwordless Authentication","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#phishing-resistant-passwordless-authentication"},{"id":"public-key-cryptography","title":"Public-Key Cryptography","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#public-key-cryptography"},{"id":"biometrics","title":"Biometrics","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#biometrics"},{"id":"passkeys-controversies","title":"Passkeys Controversies","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#passkeys-controversies"},{"id":"possession--biometrics-over-knowledge","title":"Possession \u0026 Biometrics over Knowledge","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#possession--biometrics-over-knowledge"},{"id":"device-lock-in","title":"Device Lock-in","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#device-lock-in"},{"id":"vendor-lock-in","title":"Vendor Lock-in","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#vendor-lock-in"},{"id":"proprietary-only","title":"Proprietary-only","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#proprietary-only"},{"id":"100-trust-in-big-tech","title":"100% Trust in Big Tech","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#100-trust-in-big-tech"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#conclusion"},{"id":"faqs","title":"FAQs","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#faqs"},{"id":"what-is-fido2","title":"What is FIDO2?","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#what-is-fido2"},{"id":"how-do-fido2-passkeys-work","title":"How do FIDO2 Passkeys work?","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#how-do-fido2-passkeys-work"},{"id":"what-are-the-benefits-of-fido2-passkeys","title":"What are the benefits of FIDO2 Passkeys?","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#what-are-the-benefits-of-fido2-passkeys"},{"id":"what-are-the-potential-drawbacks-of-fido2-passkeys","title":"What are the potential drawbacks of FIDO2 Passkeys?","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#what-are-the-potential-drawbacks-of-fido2-passkeys"},{"id":"can-i-use-fido2-passkeys-on-multiple-devices","title":"Can I use FIDO2 Passkeys on multiple devices?","url":"https://www.janbrennenstuhl.eu/fido-passkeys/#can-i-use-fido2-passkeys-on-multiple-devices"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/passkeys-controversy/index.md","status":"published","title":"Passwordless: Critical Notes on FIDO2 Passkeys","topics":["passwords","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/passwordless-authentication/","claim":"Passwordless login through biometrics, security keys or passkeys is more secure and easier to use than passwords, though organizations must invest in infrastructure and win user acceptance.","content_hash":"sha256:1effdb013ae52568972f9df7a1bf0ba0b20194b8e7e6cd82f7afba90288e537f","description":"Discover the world of passwordless authentication and how it's transforming cybersecurity. Learn about its benefits and types in this in-depth guide.","findings":0,"id":"jb-passwordless-authentication","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/passwordless-authentication/index.md","modified":"2025-06-09T00:00:00+02:00","published":"2023-05-07T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-07","sections":[{"id":"passwordless-authentication-a-new-era-of-security","title":"Passwordless Authentication: A New Era of Security","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#passwordless-authentication-a-new-era-of-security"},{"id":"what-is-passwordless-authentication","title":"What is Passwordless Authentication?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#what-is-passwordless-authentication"},{"id":"passwordless-authentication-vs-mfa","title":"Passwordless Authentication vs. MFA","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#passwordless-authentication-vs-mfa"},{"id":"why-is-passwordless-authentication-important","title":"Why is Passwordless Authentication Important?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#why-is-passwordless-authentication-important"},{"id":"how-does-passwordless-authentication-work","title":"How Does Passwordless Authentication Work?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#how-does-passwordless-authentication-work"},{"id":"types-of-passwordless-authentication-methods","title":"Types of Passwordless Authentication Methods","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#types-of-passwordless-authentication-methods"},{"id":"biometric-authentication-factors","title":"Biometric Authentication Factors","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#biometric-authentication-factors"},{"id":"one-time-passcodes-otp","title":"One-Time Passcodes (OTP)","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#one-time-passcodes-otp"},{"id":"hardware-tokens","title":"Hardware Tokens","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#hardware-tokens"},{"id":"software-tokens","title":"Software tokens","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#software-tokens"},{"id":"magic-links","title":"Magic Links","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#magic-links"},{"id":"the-challenges-of-passwordless-authentication","title":"The Challenges of Passwordless Authentication","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#the-challenges-of-passwordless-authentication"},{"id":"infrastructure-changes","title":"Infrastructure Changes","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#infrastructure-changes"},{"id":"user-acceptance","title":"User Acceptance","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#user-acceptance"},{"id":"passwordless-authentication-in-action","title":"Passwordless Authentication in Action","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#passwordless-authentication-in-action"},{"id":"fido2-web-authentication-webauthn","title":"FIDO2 Web Authentication (WebAuthn)","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#fido2-web-authentication-webauthn"},{"id":"apple-face-id--touch-id","title":"Apple Face ID \u0026 Touch ID","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#apple-face-id--touch-id"},{"id":"google-passwordless","title":"Google Passwordless","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#google-passwordless"},{"id":"microsoft-windows-hello","title":"Microsoft Windows Hello","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#microsoft-windows-hello"},{"id":"the-rise-of-passwordless-authentication-startups","title":"The Rise of Passwordless Authentication Startups","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#the-rise-of-passwordless-authentication-startups"},{"id":"passwordless-authentication-faqs","title":"Passwordless Authentication FAQs","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#passwordless-authentication-faqs"},{"id":"is-passwordless-authentication-safe--truly-secure","title":"Is passwordless authentication safe \u0026 truly secure?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#is-passwordless-authentication-safe--truly-secure"},{"id":"how-can-i-implement-passwordless-authentication-in-my-organization","title":"How can I implement passwordless authentication in my organization?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#how-can-i-implement-passwordless-authentication-in-my-organization"},{"id":"can-i-still-use-two-factor-authentication-2fa-with-passwordless-authentication","title":"Can I still use two-factor authentication (2FA) with passwordless authentication?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#can-i-still-use-two-factor-authentication-2fa-with-passwordless-authentication"},{"id":"what-happens-if-i-lose-my-hardware-token-or-registered-device","title":"What happens if I lose my hardware token or registered device?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#what-happens-if-i-lose-my-hardware-token-or-registered-device"},{"id":"how-does-passwordless-authentication-affect-user-privacy","title":"How does passwordless authentication affect user privacy?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#how-does-passwordless-authentication-affect-user-privacy"},{"id":"are-there-any-drawbacks-to-passwordless-authentication","title":"Are there any drawbacks to passwordless authentication?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#are-there-any-drawbacks-to-passwordless-authentication"},{"id":"passkeys-the-future-of-passwordless-authentication","title":"Passkeys: The Future of Passwordless Authentication","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#passkeys-the-future-of-passwordless-authentication"},{"id":"what-are-passkeys","title":"What are Passkeys?","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#what-are-passkeys"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/passwordless-authentication/#conclusion"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/passwordless-authentication/index.md","status":"published","title":"Passwordless Authentication: Future of Cybersecurity","topics":["identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/long-password-support/","claim":"Login systems should accept long passwords from users and password managers, hash them with Argon2id or scrypt, and still set an explicit maximum length to prevent hashing denial of service.","content_hash":"sha256:816dee74ef3cfaa0905c50311e1a521e4f80ce81a57f1945d71543096c9880af","description":"Maximize Login Security with Long Passwords and Secure Hashing. Learn How to Empower Your Login System with our Expert Guide. Read Now!","findings":0,"id":"jb-long-password-support","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/long-password-support/index.md","modified":"2025-06-08T00:00:00+02:00","published":"2023-05-06T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-06","sections":[{"id":"the-importance-of-password-security","title":"The Importance of Password Security","url":"https://www.janbrennenstuhl.eu/long-password-support/#the-importance-of-password-security"},{"id":"the-rise-of-long-passwords","title":"The Rise of Long Passwords","url":"https://www.janbrennenstuhl.eu/long-password-support/#the-rise-of-long-passwords"},{"id":"password-maximum-length-limitations","title":"Password Maximum Length Limitations","url":"https://www.janbrennenstuhl.eu/long-password-support/#password-maximum-length-limitations"},{"id":"common-password-max-length-limits","title":"Common Password Max Length Limits","url":"https://www.janbrennenstuhl.eu/long-password-support/#common-password-max-length-limits"},{"id":"maximum-password-length-why-do-length-limits-exist","title":"Maximum Password Length: Why do Length Limits Exist?","url":"https://www.janbrennenstuhl.eu/long-password-support/#maximum-password-length-why-do-length-limits-exist"},{"id":"the-consequences-of-short-password-limits","title":"The Consequences of Short Password Limits","url":"https://www.janbrennenstuhl.eu/long-password-support/#the-consequences-of-short-password-limits"},{"id":"the-benefits-of-long-passwords","title":"The Benefits of Long Passwords","url":"https://www.janbrennenstuhl.eu/long-password-support/#the-benefits-of-long-passwords"},{"id":"secure-password-enhanced-security-through-entropy","title":"Secure Password: Enhanced Security Through Entropy","url":"https://www.janbrennenstuhl.eu/long-password-support/#secure-password-enhanced-security-through-entropy"},{"id":"resistance-to-brute-force-attacks","title":"Resistance to Brute-force Attacks","url":"https://www.janbrennenstuhl.eu/long-password-support/#resistance-to-brute-force-attacks"},{"id":"encouraging-the-use-of-password-managers","title":"Encouraging the Use of Password Managers","url":"https://www.janbrennenstuhl.eu/long-password-support/#encouraging-the-use-of-password-managers"},{"id":"how-to-support-long-passwords-in-your-login-system","title":"How to Support Long Passwords in Your Login System","url":"https://www.janbrennenstuhl.eu/long-password-support/#how-to-support-long-passwords-in-your-login-system"},{"id":"updating-your-database-and-storage","title":"Updating Your Database and Storage","url":"https://www.janbrennenstuhl.eu/long-password-support/#updating-your-database-and-storage"},{"id":"adapting-to-longer-password-storage","title":"Adapting to Longer Password Storage","url":"https://www.janbrennenstuhl.eu/long-password-support/#adapting-to-longer-password-storage"},{"id":"the-importance-of-secure-hashing","title":"The Importance of Secure Hashing","url":"https://www.janbrennenstuhl.eu/long-password-support/#the-importance-of-secure-hashing"},{"id":"transitioning-existing-user-data","title":"Transitioning Existing User Data","url":"https://www.janbrennenstuhl.eu/long-password-support/#transitioning-existing-user-data"},{"id":"implementing-front-end-changes","title":"Implementing Front-end Changes","url":"https://www.janbrennenstuhl.eu/long-password-support/#implementing-front-end-changes"},{"id":"adapting-user-interface-elements","title":"Adapting User Interface Elements","url":"https://www.janbrennenstuhl.eu/long-password-support/#adapting-user-interface-elements"},{"id":"enabling-client-side-input-validation","title":"Enabling Client-side Input Validation","url":"https://www.janbrennenstuhl.eu/long-password-support/#enabling-client-side-input-validation"},{"id":"encouraging-strong-password-practices","title":"Encouraging Strong Password Practices","url":"https://www.janbrennenstuhl.eu/long-password-support/#encouraging-strong-password-practices"},{"id":"password-manager-support","title":"Password Manager Support","url":"https://www.janbrennenstuhl.eu/long-password-support/#password-manager-support"},{"id":"back-end-considerations","title":"Back-end Considerations","url":"https://www.janbrennenstuhl.eu/long-password-support/#back-end-considerations"},{"id":"implementing-server-side-password-validation","title":"Implementing Server-side Password Validation","url":"https://www.janbrennenstuhl.eu/long-password-support/#implementing-server-side-password-validation"},{"id":"ensuring-backward-compatibility","title":"Ensuring Backward Compatibility","url":"https://www.janbrennenstuhl.eu/long-password-support/#ensuring-backward-compatibility"},{"id":"long-password-denial-of-service","title":"Long Password Denial of Service","url":"https://www.janbrennenstuhl.eu/long-password-support/#long-password-denial-of-service"},{"id":"testing--monitoring-your-updated-system","title":"Testing \u0026 Monitoring Your Updated System","url":"https://www.janbrennenstuhl.eu/long-password-support/#testing--monitoring-your-updated-system"},{"id":"best-practices-for-long-password-support","title":"Best Practices for Long Password Support","url":"https://www.janbrennenstuhl.eu/long-password-support/#best-practices-for-long-password-support"},{"id":"adopting-a-balanced-password-policy","title":"Adopting a Balanced Password Policy","url":"https://www.janbrennenstuhl.eu/long-password-support/#adopting-a-balanced-password-policy"},{"id":"regularly-reviewing--updating-security-measures","title":"Regularly Reviewing \u0026 Updating Security Measures","url":"https://www.janbrennenstuhl.eu/long-password-support/#regularly-reviewing--updating-security-measures"},{"id":"staying-informed-about-new-threats--trends","title":"Staying Informed About New Threats \u0026 Trends","url":"https://www.janbrennenstuhl.eu/long-password-support/#staying-informed-about-new-threats--trends"},{"id":"summary","title":"Summary","url":"https://www.janbrennenstuhl.eu/long-password-support/#summary"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/long-password-support/#frequently-asked-questions-faqs"}],"series":"passwords","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/long-password-support/index.md","status":"published","title":"Long Password Support for Safer Login Systems","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/max-password-length/","claim":"Length matters more than complexity: use unique passwords of at least 12 to 16 characters, and services should not cap passwords below 64 characters.","content_hash":"sha256:a9e2b6f1a843e656c2525be3ee5c8344accc242ef703040d2f8f97e08997f1cf","description":"A comprehensive password guide with max password length recommendation to ensure your accounts stay safe and secure.","findings":0,"id":"jb-password-length-recommendation","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/max-password-length/index.md","modified":"2025-06-15T00:00:00+02:00","published":"2023-05-04T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-05-04","sections":[{"id":"password-length-recommendations","title":"Password Length Recommendations","url":"https://www.janbrennenstuhl.eu/max-password-length/#password-length-recommendations"},{"id":"a-look-into-password-length","title":"A Look into Password Length","url":"https://www.janbrennenstuhl.eu/max-password-length/#a-look-into-password-length"},{"id":"the-nist-guidelines","title":"The NIST Guidelines","url":"https://www.janbrennenstuhl.eu/max-password-length/#the-nist-guidelines"},{"id":"why-no-max-length","title":"Why No Max Length?","url":"https://www.janbrennenstuhl.eu/max-password-length/#why-no-max-length"},{"id":"so-whats-the-ideal-length","title":"So, What’s the Ideal Length?","url":"https://www.janbrennenstuhl.eu/max-password-length/#so-whats-the-ideal-length"},{"id":"creating-strong-passwords","title":"Creating Strong Passwords","url":"https://www.janbrennenstuhl.eu/max-password-length/#creating-strong-passwords"},{"id":"complex-passwords--the-importance-of-unpredictability","title":"Complex Passwords \u0026 the Importance of Unpredictability","url":"https://www.janbrennenstuhl.eu/max-password-length/#complex-passwords--the-importance-of-unpredictability"},{"id":"passphrases-a-password-manager-alternative","title":"Passphrases: A Password Manager Alternative","url":"https://www.janbrennenstuhl.eu/max-password-length/#passphrases-a-password-manager-alternative"},{"id":"use-a-password-manager","title":"Use a Password Manager","url":"https://www.janbrennenstuhl.eu/max-password-length/#use-a-password-manager"},{"id":"common-password-pitfalls","title":"Common Password Pitfalls","url":"https://www.janbrennenstuhl.eu/max-password-length/#common-password-pitfalls"},{"id":"short-passwords","title":"Short Passwords","url":"https://www.janbrennenstuhl.eu/max-password-length/#short-passwords"},{"id":"reusing-passwords","title":"Reusing Passwords","url":"https://www.janbrennenstuhl.eu/max-password-length/#reusing-passwords"},{"id":"writing-passwords-down","title":"Writing Passwords Down","url":"https://www.janbrennenstuhl.eu/max-password-length/#writing-passwords-down"},{"id":"ignoring-two-factor-authentication","title":"Ignoring Two-Factor Authentication","url":"https://www.janbrennenstuhl.eu/max-password-length/#ignoring-two-factor-authentication"},{"id":"faqs","title":"FAQs","url":"https://www.janbrennenstuhl.eu/max-password-length/#faqs"},{"id":"what-is-the-max-password-length-recommendation","title":"What is the Max Password Length Recommendation?","url":"https://www.janbrennenstuhl.eu/max-password-length/#what-is-the-max-password-length-recommendation"},{"id":"how-does-password-length-affect-security--brute-force-attacks","title":"How does Password Length affect Security \u0026 Brute-Force Attacks?","url":"https://www.janbrennenstuhl.eu/max-password-length/#how-does-password-length-affect-security--brute-force-attacks"},{"id":"what-is-a-passphrase--how-is-it-different-from-a-password","title":"What is a Passphrase \u0026 How is it different from a Password?","url":"https://www.janbrennenstuhl.eu/max-password-length/#what-is-a-passphrase--how-is-it-different-from-a-password"},{"id":"why-should-i-avoid-reusing-passwords","title":"Why should I avoid Reusing Passwords?","url":"https://www.janbrennenstuhl.eu/max-password-length/#why-should-i-avoid-reusing-passwords"},{"id":"what-is-a-password-manager-and-how-can-it-help-me","title":"What is a password manager, and how can it help me?","url":"https://www.janbrennenstuhl.eu/max-password-length/#what-is-a-password-manager-and-how-can-it-help-me"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/max-password-length/#conclusion"},{"id":"additional-tips-for-strengthening-your-password-security","title":"Additional Tips for Strengthening Your Password Security","url":"https://www.janbrennenstuhl.eu/max-password-length/#additional-tips-for-strengthening-your-password-security"}],"series":"passwords","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/password-length-recommendation/index.md","status":"published","title":"Max Password Length: A Secure Password Guide","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/","claim":"Password strength meters produce stronger passwords when users change passwords on important accounts, but make no observable difference on unimportant ones.","content_hash":"sha256:edf36909393140be92d48ba18aa1be1d7407da325d47985c1e4b889009470f3c","description":"When password strength meters change behavior, why many deployed meters mislead, and how to build a meter and policy that help.","findings":5,"id":"jb-research-password-policy","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-05-03T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#the-studies-in-detail"},{"id":"impact-of-password-meters-on-password-selection","title":"Impact of Password Meters on Password Selection","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#impact-of-password-meters-on-password-selection"},{"id":"analyzing-password-strength-meters","title":"Analyzing Password-Strength Meters","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#analyzing-password-strength-meters"},{"id":"low-budget-password-strength-estimation","title":"Low-Budget Password Strength Estimation","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#low-budget-password-strength-estimation"},{"id":"modeling-password-guessability-using-neural-networks","title":"Modeling Password Guessability Using Neural Networks","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#modeling-password-guessability-using-neural-networks"},{"id":"practical-recommendations-for-stronger-more-usable-passwords","title":"Practical Recommendations for Stronger, More Usable Passwords","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#practical-recommendations-for-stronger-more-usable-passwords"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/password-policy/index.md","status":"published","title":"Do password strength meters work?","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/honeytoken/","claim":"Fake customer accounts with plausible credentials, planted in the user database and watched by the identity provider, alert a security team when attackers use breached data, though they cannot prevent attacks.","content_hash":"sha256:c710829becee8ded90d2cd76a13e193bba6c9f1e2c28da3b8841a0c52952fe9c","description":"Threat Detection: Discover the power of Honeytoken in credential breach detection, and learn how they bolster defenses against authentication attacks.","findings":0,"id":"jb-honeytoken","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/honeytoken/index.md","modified":"2023-05-31T00:00:00+02:00","published":"2023-04-29T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-04-29","sections":[{"id":"the-need-for-honeytoken-accounts","title":"The Need for Honeytoken Accounts","url":"https://www.janbrennenstuhl.eu/honeytoken/#the-need-for-honeytoken-accounts"},{"id":"threat-detection--credential-breaches","title":"Threat detection \u0026 Credential Breaches","url":"https://www.janbrennenstuhl.eu/honeytoken/#threat-detection--credential-breaches"},{"id":"what-are-honeytoken-accounts-and-how-do-they-work","title":"What are Honeytoken accounts, and how do they work?","url":"https://www.janbrennenstuhl.eu/honeytoken/#what-are-honeytoken-accounts-and-how-do-they-work"},{"id":"types-of-honey-tokens","title":"Types of Honey Tokens","url":"https://www.janbrennenstuhl.eu/honeytoken/#types-of-honey-tokens"},{"id":"fake-email-addresses","title":"Fake Email Addresses","url":"https://www.janbrennenstuhl.eu/honeytoken/#fake-email-addresses"},{"id":"fake-database-records","title":"Fake Database Records","url":"https://www.janbrennenstuhl.eu/honeytoken/#fake-database-records"},{"id":"fake-executable-files","title":"Fake Executable Files","url":"https://www.janbrennenstuhl.eu/honeytoken/#fake-executable-files"},{"id":"how-to-create-a-honeytoken-account","title":"How to create a Honeytoken Account?","url":"https://www.janbrennenstuhl.eu/honeytoken/#how-to-create-a-honeytoken-account"},{"id":"how-to-detect-threats-with-honeytoken-accounts","title":"How to detect threats with Honeytoken Accounts?","url":"https://www.janbrennenstuhl.eu/honeytoken/#how-to-detect-threats-with-honeytoken-accounts"},{"id":"frequently-asked-questions-faqs","title":"Frequently Asked Questions (FAQs)","url":"https://www.janbrennenstuhl.eu/honeytoken/#frequently-asked-questions-faqs"},{"id":"what-is-a-honeypot-vs-honey-token","title":"What Is a Honeypot vs. Honey Token?","url":"https://www.janbrennenstuhl.eu/honeytoken/#what-is-a-honeypot-vs-honey-token"},{"id":"can-honeytokens-prevent-supply-chain-attacks","title":"Can Honeytokens Prevent Supply Chain Attacks?","url":"https://www.janbrennenstuhl.eu/honeytoken/#can-honeytokens-prevent-supply-chain-attacks"},{"id":"how-can-honeytokens-help-security-teams","title":"How can Honeytokens help security teams?","url":"https://www.janbrennenstuhl.eu/honeytoken/#how-can-honeytokens-help-security-teams"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/honeytoken/index.md","status":"published","title":"Honeytoken: Authentication Attack Breach Detection","topics":["application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/","claim":"Device-based login challenges block far more account takeover attempts than knowledge-based ones.","content_hash":"sha256:dc712a4259a31acce848fc23c85ad40f77d3a0ab2f3171145a5a404d45036b66","description":"Which login challenges stop account takeover, what they cost in friction, and how risk scoring picks the logins to challenge.","findings":5,"id":"jb-research-reinforced-authentication","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-04-27T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#the-studies-in-detail"},{"id":"evaluating-login-challenges-as-a-defense-against-account-takeover","title":"Evaluating Login Challenges as a Defense Against Account Takeover","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#evaluating-login-challenges-as-a-defense-against-account-takeover"},{"id":"using-guessed-passwords-to-thwart-online-guessing","title":"Using Guessed Passwords to Thwart Online Guessing","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#using-guessed-passwords-to-thwart-online-guessing"},{"id":"a-statistical-approach-to-measuring-user-authenticity","title":"A Statistical Approach to Measuring User Authenticity","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#a-statistical-approach-to-measuring-user-authenticity"},{"id":"distinguishing-attacks-from-legitimate-traffic-at-an-authentication-server","title":"Distinguishing Attacks from Legitimate Traffic at an Authentication Server","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#distinguishing-attacks-from-legitimate-traffic-at-an-authentication-server"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/reinforced-authentication/index.md","status":"published","title":"Do login challenges and risk scoring stop account takeover?","topics":["identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/","claim":"Somewhere between 43% and 51% of users reuse the same password across multiple sites.","content_hash":"sha256:3ba491404803e62351306c5771cc1fa2c22db4646f1cc5757afd4ed9eeba9354","description":"How much people reuse passwords, measured in studies from 2007 to 2018, and what engineers and product teams can do about it.","findings":5,"id":"jb-research-password-reuse","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-04-27T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#the-studies-in-detail"},{"id":"observing-passwords-in-their-natural-habitat","title":"Observing Passwords in Their Natural Habitat","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#observing-passwords-in-their-natural-habitat"},{"id":"the-tangled-web-of-password-reuse","title":"The Tangled Web of Password Reuse","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#the-tangled-web-of-password-reuse"},{"id":"understanding-password-choices-how-frequently-entered-passwords-are-re-used-across-websites","title":"Understanding Password Choices: How Frequently Entered Passwords are Re-used Across Websites","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#understanding-password-choices-how-frequently-entered-passwords-are-re-used-across-websites"},{"id":"a-large-scale-study-of-web-password-habits","title":"A Large-Scale Study of Web Password Habits","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#a-large-scale-study-of-web-password-habits"},{"id":"designing-password-reuse-notifications","title":"Designing Password-Reuse Notifications","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#designing-password-reuse-notifications"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/password-reuse/index.md","status":"published","title":"How common is password reuse?","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/password-policy/","claim":"A strong, usable password policy requires at least 12 characters, checks guessability, blocks common and breached passwords, and drops composition rules and forced password changes.","content_hash":"sha256:e9dd4bcc5dbbf0118f7fe127b530dd35c0b2ee5f1b9191f9cedeba7b3c2110f1","description":"Account Security ➢ Learn how to create a secure and user-friendly password policy that strikes the perfect balance between web security and user experience","findings":0,"id":"jb-password-policy","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/password-policy/index.md","modified":"2025-06-09T00:00:00+02:00","published":"2023-04-26T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-04-26","sections":[{"id":"importance-of-password-policy-best-practices","title":"Importance of Password Policy Best Practices","url":"https://www.janbrennenstuhl.eu/password-policy/#importance-of-password-policy-best-practices"},{"id":"key-components-of-a-modern-password-policy","title":"Key Components of a Modern Password Policy","url":"https://www.janbrennenstuhl.eu/password-policy/#key-components-of-a-modern-password-policy"},{"id":"why-arbitrary-password-policies-are-bad","title":"Why Arbitrary Password Policies are Bad","url":"https://www.janbrennenstuhl.eu/password-policy/#why-arbitrary-password-policies-are-bad"},{"id":"stop-password-complexity-requirements","title":"Stop Password Complexity Requirements!","url":"https://www.janbrennenstuhl.eu/password-policy/#stop-password-complexity-requirements"},{"id":"best-practices-for-implementing-a-password-security-policy","title":"Best Practices for Implementing a Password Security Policy","url":"https://www.janbrennenstuhl.eu/password-policy/#best-practices-for-implementing-a-password-security-policy"},{"id":"minimum-password-length","title":"Minimum Password Length","url":"https://www.janbrennenstuhl.eu/password-policy/#minimum-password-length"},{"id":"minimum-password-strength","title":"Minimum Password Strength","url":"https://www.janbrennenstuhl.eu/password-policy/#minimum-password-strength"},{"id":"password-blocklists","title":"Password Blocklists","url":"https://www.janbrennenstuhl.eu/password-policy/#password-blocklists"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/password-policy/#conclusion"},{"id":"10-dos--donts-for-an-effective-password-strength-policy","title":"10 Dos \u0026 Donts For An Effective Password Strength Policy","url":"https://www.janbrennenstuhl.eu/password-policy/#10-dos--donts-for-an-effective-password-strength-policy"},{"id":"frequently-asked-questions-faq","title":"Frequently Asked Questions (FAQ)","url":"https://www.janbrennenstuhl.eu/password-policy/#frequently-asked-questions-faq"},{"id":"do-password-meters-discourage-users-from-using-complex-passwords","title":"Do password meters discourage users from using complex passwords?","url":"https://www.janbrennenstuhl.eu/password-policy/#do-password-meters-discourage-users-from-using-complex-passwords"},{"id":"should-password-meters-take-into-account-the-likelihood-of-a-password-being-guessed-by-an-attacker","title":"Should password meters take into account the likelihood of a password being guessed by an attacker?","url":"https://www.janbrennenstuhl.eu/password-policy/#should-password-meters-take-into-account-the-likelihood-of-a-password-being-guessed-by-an-attacker"},{"id":"should-i-use-a-blacklist-of-commonly-used-passwords-to-prevent-users-from-using-weak-passwords","title":"Should I use a blacklist of commonly used passwords to prevent users from using weak passwords?","url":"https://www.janbrennenstuhl.eu/password-policy/#should-i-use-a-blacklist-of-commonly-used-passwords-to-prevent-users-from-using-weak-passwords"},{"id":"should-i-use-a-password-manager-to-create-and-store-strong-passwords","title":"Should I use a password manager to create and store strong passwords?","url":"https://www.janbrennenstuhl.eu/password-policy/#should-i-use-a-password-manager-to-create-and-store-strong-passwords"},{"id":"is-it-safe-to-use-the-same-password-for-multiple-accounts","title":"Is it safe to use the same password for multiple accounts?","url":"https://www.janbrennenstuhl.eu/password-policy/#is-it-safe-to-use-the-same-password-for-multiple-accounts"}],"series":"passwords","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/password-policy/index.md","status":"published","title":"How to Design a Strong \u0026 Usable Password Policy","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/password-manager-friendly/","claim":"Login forms work well with password managers when inputs carry the right autocomplete values, length rules sit in pattern or passwordrules attributes, and the site offers /.well-known/change-password.","content_hash":"sha256:57d75bd56f03d3e2f84ba93ee8f37535b6b740184458c152da0fbb812ace5470","description":"Password Security | Use HTML features to create password-manager friendly login forms for a seamless user experience \u0026 enhanced web security","findings":0,"id":"jb-password-manager-friendly","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/password-manager-friendly/index.md","modified":"2025-06-08T00:00:00+02:00","published":"2023-04-23T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2023-04-23","sections":[{"id":"what-is-a-password-manager","title":"What is a password manager?","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#what-is-a-password-manager"},{"id":"understanding-the-limitations-of-traditional-login-forms","title":"Understanding the limitations of traditional login forms","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#understanding-the-limitations-of-traditional-login-forms"},{"id":"best-practices-for-designing-password-manager-friendly-login-forms","title":"Best practices for designing password-manager friendly login forms","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#best-practices-for-designing-password-manager-friendly-login-forms"},{"id":"improving-accessibility-with-password-manager-friendly-login-forms","title":"Improving accessibility with password-manager friendly login forms","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#improving-accessibility-with-password-manager-friendly-login-forms"},{"id":"increasing-security-with-password-manager-friendly-login-forms","title":"Increasing security with password-manager friendly login forms","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#increasing-security-with-password-manager-friendly-login-forms"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/password-manager-friendly/#conclusion"}],"series":"passwords","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/password-manager-friendly/index.md","status":"published","title":"How to: Password-Manager Friendly Login Forms","topics":["passwords"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/","claim":"Checking credentials against breach data and adding device and location risk signals to the login decision reduce the risk from stolen passwords.","content_hash":"sha256:f4aa991995860b9691969969eb41897d21fc7b650e1b086faeeeda35f5e96fbd","description":"How often breached credentials show up at login, how to check them without leaking the password, and which risk signals help.","findings":4,"id":"jb-research-compromised-credentials","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-04-21T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#the-studies-in-detail"},{"id":"protocols-for-checking-compromised-credentials","title":"Protocols for Checking Compromised Credentials","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#protocols-for-checking-compromised-credentials"},{"id":"protecting-accounts-from-credential-stuffing-with-password-breach-alerting","title":"Protecting accounts from credential stuffing with password breach alerting","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#protecting-accounts-from-credential-stuffing-with-password-breach-alerting"},{"id":"data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials","title":"Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/compromised-credentials/index.md","status":"published","title":"How do you protect accounts from stolen credentials?","topics":["passwords","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/","claim":"72% of the website account recovery mechanisms studied had at least one implementation weakness.","content_hash":"sha256:7fc6f3e9e141c5d0f04e184a864f10067f396a1b38ba79f679d7ae80e49ae854","description":"Where email-based password reset flows go wrong, measured across 366 websites, and the controls that close each gap.","findings":4,"id":"jb-research-account-recovery","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-04-21T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#the-studies-in-detail"},{"id":"security-analysis-of-email-based-password-reset-procedures","title":"Security Analysis of Email-Based Password Reset Procedures","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#security-analysis-of-email-based-password-reset-procedures"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/account-recovery/index.md","status":"published","title":"How secure are email-based password resets?","topics":["identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/","claim":"At least 35 of 75 popular online services studied were vulnerable to account pre-hijacking attacks.","content_hash":"sha256:0eeb9ec4674d24a6ec1d1c3830afa3d9f6d4ebbc03a65f94f5bad22a67782cae","description":"Two ways attackers take over accounts, pre-hijacking at sign-up and paid hack-for-hire phishing, and the controls that stop each.","findings":4,"id":"jb-research-account-hijacking","kind":"guide","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/index.md","modified":"2026-10-13T00:00:00+02:00","published":"2023-04-21T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[{"id":"key-findings","title":"Key findings","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#key-findings"},{"id":"evidence","title":"Evidence","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#evidence"},{"id":"what-to-do","title":"What to do","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#what-to-do"},{"id":"for-engineers","title":"For engineers","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#for-engineers"},{"id":"for-product-and-ux","title":"For product and UX","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#for-product-and-ux"},{"id":"the-studies-in-detail","title":"The studies in detail","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#the-studies-in-detail"},{"id":"account-pre-hijacking-attacks-security-failures-in-user-account-creation","title":"Account Pre-Hijacking Attacks: Security Failures in User Account Creation","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#account-pre-hijacking-attacks-security-failures-in-user-account-creation"},{"id":"hack-for-hire-exploring-the-emerging-market-for-account-hijacking","title":"Hack for Hire: Exploring the Emerging Market for Account Hijacking","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#hack-for-hire-exploring-the-emerging-market-for-account-hijacking"},{"id":"related","title":"Related","url":"https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/#related"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/knowledge-base/account-security/account-hijacking/index.md","status":"published","title":"How do attackers take over accounts?","topics":["identity-authentication","application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/about/","claim":"","content_hash":"sha256:d1dae58096ed04972e00b3a134d1eee347aa4819075688c87ddae64125b1f975","description":"Jan Brennenstuhl is a principal engineer focused on application security, agentic engineering, and the intersection of security, usability, and automation.","findings":0,"id":"jb-author","kind":"profile","license":{"name":"Not specified","scope":"No reuse license specified for this page.","url":""},"markdown_url":"https://www.janbrennenstuhl.eu/about/index.md","modified":"2025-06-09T00:00:00+02:00","published":"2021-04-08T00:00:00+02:00","review_basis":"","review_status":"not-reviewed","reviewed":"","sections":[],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/page/jan-brennenstuhl/index.md","status":"published","title":"About Jan Brennenstuhl","topics":["application-security","identity-authentication","agentic-engineering"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/assertj-null-not-blank/","claim":"AssertJ's isNotBlank() passes for a null string, unlike Apache Commons StringUtils and Hibernate Validator, so Java tests that rely on it can miss null values.","content_hash":"sha256:26261fe434c7583b660ebe9c4631a12b6c073f20ad7bbf8f31081cf42e251cfd","description":"This AssertJ bug could lead to severe issues: In Java, a blank String is a CharSequence that is empty, null or whitespace only – except when you use AssertJ!","findings":0,"id":"jb-assertj-null-not-blank","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/assertj-null-not-blank/index.md","modified":"2025-07-06T00:00:00+02:00","published":"2017-09-05T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2017-09-05","sections":[],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/assertj-null-not-blank/index.md","status":"published","title":"Learning AssertJ: Null ain't Blank","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/","claim":"The purpose of JWT is stateless authentication: signed, self-contained tokens let services verify identity locally without a central session store, at the cost of hard revocation and token theft risk.","content_hash":"sha256:d3e1190b90fefc752ce284a3647a9330e048523975279c7367355a30ab7423e2","description":"Establish stateless authentication with JWT. Uncover fundamental ideas of JSON Web Token, security concepts \u0026 commonpitfalls to avoid in this concise guide.","findings":0,"id":"jb-purpose-of-jwt","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2017-04-28T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2017-04-28","sections":[{"id":"stateless-sessions-thanks-to-json-web-token","title":"Stateless Sessions Thanks to JSON Web Token","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#stateless-sessions-thanks-to-json-web-token"},{"id":"what-is-jwt","title":"What is JWT?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#what-is-jwt"},{"id":"definition","title":"Definition","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#definition"},{"id":"components-of-jwt-tokens","title":"Components of JWT tokens","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#components-of-jwt-tokens"},{"id":"the-need-for-stateless-authentication","title":"The Need for Stateless Authentication","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#the-need-for-stateless-authentication"},{"id":"stateful-authentication","title":"Stateful Authentication","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#stateful-authentication"},{"id":"stateless-authentication","title":"Stateless Authentication","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#stateless-authentication"},{"id":"stateful-vs-stateless","title":"Stateful vs. Stateless","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#stateful-vs-stateless"},{"id":"how-jwt-enables-stateless-authentication","title":"How JWT Enables Stateless Authentication","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#how-jwt-enables-stateless-authentication"},{"id":"token-based-authentication","title":"Token-based authentication","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#token-based-authentication"},{"id":"json-web-signature-jws","title":"JSON Web Signature (JWS)","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#json-web-signature-jws"},{"id":"pros-and-cons-of-stateless-authentication-with-jwt","title":"Pros and Cons of Stateless Authentication with JWT","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#pros-and-cons-of-stateless-authentication-with-jwt"},{"id":"advantages","title":"Advantages","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#advantages"},{"id":"disadvantages","title":"Disadvantages","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#disadvantages"},{"id":"understanding-jwt-workflow","title":"Understanding JWT Workflow","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#understanding-jwt-workflow"},{"id":"token-creation","title":"Token Creation","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#token-creation"},{"id":"token-verification","title":"Token Verification","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#token-verification"},{"id":"token-expiration","title":"Token Expiration","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#token-expiration"},{"id":"use-cases-for-jwt","title":"Use Cases for JWT","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#use-cases-for-jwt"},{"id":"security-concerns--considerations","title":"Security Concerns \u0026 Considerations","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#security-concerns--considerations"},{"id":"best-practices-for-jwt-implementation","title":"Best Practices for JWT Implementation","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#best-practices-for-jwt-implementation"},{"id":"conclusion","title":"Conclusion","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#conclusion"},{"id":"faqs","title":"FAQs","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#faqs"},{"id":"what-is-the-main-purpose-of-using-jwt-in-stateless-authentication","title":"What is the main purpose of using JWT in stateless authentication?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#what-is-the-main-purpose-of-using-jwt-in-stateless-authentication"},{"id":"how-can-i-prevent-jwt-theft","title":"How can I prevent JWT theft?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#how-can-i-prevent-jwt-theft"},{"id":"can-i-use-jwt-for-authorization-as-well-as-authentication","title":"Can I use JWT for authorization as well as authentication?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#can-i-use-jwt-for-authorization-as-well-as-authentication"},{"id":"do-i-need-to-store-jwt-session-data-in-a-database","title":"Do I need to store JWT session data in a database?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#do-i-need-to-store-jwt-session-data-in-a-database"},{"id":"how-do-i-handle-jwt-expiration","title":"How do I handle JWT expiration?","url":"https://www.janbrennenstuhl.eu/jwt-stateless-authentication/#how-do-i-handle-jwt-expiration"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/purpose-of-jwt/index.md","status":"published","title":"The Purpose of JWT: Stateless Authentication","topics":["tokens-jwt","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/","claim":"Contributing a small fix to a long-lived library such as Spring Security OAuth means fitting its old Java version, minimal dependencies and backward compatibility, and it teaches you the underlying RFCs.","content_hash":"sha256:b7cb8ce06fc8e397e085e56a815d99e00dbd4886f03afc29db78df49f046ed89","description":"Open-Source Contribution | I fixed a small HTTP header extractor in Spring Security OAuth. Here's what happened \u0026 what I learned.","findings":0,"id":"jb-spring-security-oauth","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/index.md","modified":"2017-02-16T00:00:00+01:00","published":"2017-02-01T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2017-02-01","sections":[{"id":"i-fixed-something-for-me","title":"I fixed something for me","url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/#i-fixed-something-for-me"},{"id":"i-fixed-something-for-someone-else","title":"I fixed something for someone else","url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/#i-fixed-something-for-someone-else"},{"id":"i-learned-more-about-library-maintenance","title":"I learned more about Library Maintenance","url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/#i-learned-more-about-library-maintenance"},{"id":"i-learned-more-about-http-headers","title":"I learned more about HTTP Headers","url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/#i-learned-more-about-http-headers"},{"id":"the-simplest-piece-of-work-can-lead-you-anywhere","title":"The simplest piece of work can lead you anywhere","url":"https://www.janbrennenstuhl.eu/spring-security-oauth-rfc/#the-simplest-piece-of-work-can-lead-you-anywhere"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/spring-security-oauth/index.md","status":"published","title":"On Making Spring Security OAuth RFC-compliant","topics":["engineering-practice","identity-authentication"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/","claim":"GitHub Enterprise users should patch a critical SAML authentication bypass right away, and Twitter's login alert email shows how a badly worded security notification can work against users.","content_hash":"sha256:8bc5262662a6f563f19ed6be72f38718366844eff0896347f0317644ab545779","description":"Reading notes from January 2017: weak cryptography in Google Keyczar, a critical SAML authentication bypass in GitHub Enterprise, and what a Twitter login alert gets wrong.","findings":0,"id":"jb-readme-1","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/index.md","modified":"2025-06-08T00:00:00+02:00","published":"2017-01-15T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2017-01-15","sections":[{"id":"weak-crypto-in-google-cloud-platform","title":"Weak Crypto in Google Cloud Platform?!","url":"https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/#weak-crypto-in-google-cloud-platform"},{"id":"github-saml-vulnerability","title":"GitHub SAML Vulnerability","url":"https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/#github-saml-vulnerability"},{"id":"bad-security-ux-at-twitter","title":"Bad Security UX at Twitter","url":"https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/#bad-security-ux-at-twitter"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/readme-1/index.md","status":"published","title":"Weak Crypto, Github SAML Attack \u0026 Twitter Security UX","topics":["application-security"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/single-use-jwt/","claim":"You can make a JWT single-use without a token store by signing it with server-side state that the operation changes, such as the current password hash in a password reset.","content_hash":"sha256:82ffab94012cc03c894a347d0870ef68ded385e65aa5b0ff121ba0e562edd1ac","description":"Discover JWTs as one-time tokens in secure authentication. Explore benefits, implementation, and real-world use cases. Explore Single-Use JWT!","findings":0,"id":"jb-single-use-jwt","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/single-use-jwt/index.md","modified":"2025-06-01T00:00:00+02:00","published":"2016-12-30T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2016-12-30","sections":[{"id":"understanding-json-web-tokens","title":"Understanding JSON Web Tokens","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#understanding-json-web-tokens"},{"id":"what-are-json-web-tokens","title":"What are JSON Web Tokens?","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#what-are-json-web-tokens"},{"id":"the-power-of-json-web-token","title":"The Power of JSON Web Token","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#the-power-of-json-web-token"},{"id":"what-is-a-one-time-use-token","title":"What Is a One Time Use Token?","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#what-is-a-one-time-use-token"},{"id":"advantages-of-single-use-token-validation","title":"Advantages of Single-Use Token Validation","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#advantages-of-single-use-token-validation"},{"id":"implementing-one-time-jwt-token","title":"Implementing One-Time JWT Token","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#implementing-one-time-jwt-token"},{"id":"generating-and-validating-tokens","title":"Generating and Validating Tokens","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#generating-and-validating-tokens"},{"id":"user-experience-and-usability-challenges","title":"User Experience and Usability Challenges","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#user-experience-and-usability-challenges"},{"id":"security-issues--risks","title":"Security Issues \u0026 Risks","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#security-issues--risks"},{"id":"embracing-the-future-of-stateless-one-time-tokens","title":"Embracing the Future of Stateless One-Time Tokens","url":"https://www.janbrennenstuhl.eu/single-use-jwt/#embracing-the-future-of-stateless-one-time-tokens"}],"series":"jwt","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/single-use-jwt/index.md","status":"published","title":"Single-Use JWT: Unlocking the Power of Stateless One Time Token","topics":["tokens-jwt"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/dynamodb-backup/","claim":"You can back up DynamoDB tables with nightly Data Pipeline exports to S3, use a Lambda function to restage them into a test environment, and restore from the same backups.","content_hash":"sha256:497b6cb46a017d5ef0f5cb36698680e8fbf51b48c80fe0e446e5002d1fbb2efa","description":"Exploring a backup and recovery strategy for AWS DynamoDB, for optimal system performance and reliability","findings":0,"id":"jb-dynamodb-backup","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/dynamodb-backup/index.md","modified":"2025-06-08T00:00:00+02:00","published":"2016-01-18T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2016-01-18","sections":[{"id":"dynamodb-threat-scenario","title":"DynamoDB Threat Scenario","url":"https://www.janbrennenstuhl.eu/dynamodb-backup/#dynamodb-threat-scenario"},{"id":"dynamodb-w-aws-datapipeline--lambda","title":"DynamoDB w\\ AWS Datapipeline \u0026 Lambda","url":"https://www.janbrennenstuhl.eu/dynamodb-backup/#dynamodb-w-aws-datapipeline--lambda"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/dynamodb-backup/index.md","status":"published","title":"AWS DynamoDB: Backup \u0026 Recovery Strategy","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/microservice-evolution/","claim":"Microservices keep their benefits only if teams cut them down regularly: one service grew from 5k to 15k lines of code in a year and shrank back to about 5k after a split.","content_hash":"sha256:961448c7f50aa03b05f33e82714dc9dbe20d07c1d7ee35516e7aa9f4ab44d548","description":"Keeping microservices micro is a must if you want to benefit from them. How to visualize git histories and what you can learn from it. Devops ✓ Git ✓ Gource ✓","findings":0,"id":"jb-microservice-evolution","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/microservice-evolution/index.md","modified":"2023-04-21T00:00:00+02:00","published":"2015-05-21T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-05-21","sections":[{"id":"microservices-self-contained-systems--integrated-applications","title":"Microservices, Self-contained Systems \u0026 Integrated Applications","url":"https://www.janbrennenstuhl.eu/microservice-evolution/#microservices-self-contained-systems--integrated-applications"},{"id":"microservices-dont-letem-grow","title":"Microservices, Don’t let’em grow!","url":"https://www.janbrennenstuhl.eu/microservice-evolution/#microservices-dont-letem-grow"},{"id":"tldr---take-a-radical-approach","title":"tl;dr - Take a radical approach!","url":"https://www.janbrennenstuhl.eu/microservice-evolution/#tldr---take-a-radical-approach"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/microservice-evolution/index.md","status":"published","title":"Evolution of a Microservice: A Git History Visualisation","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/aws-cloudformation/","claim":"CloudFormation misuses JSON as a scripting language, which makes templates hard to read and maintain, and tools such as CFN-Sphere add YAML templates and stack dependency resolution on top.","content_hash":"sha256:fe4edf52b016ceb082bff8f781f05635634acd1e1847b900449a4d367357984c","description":"Infrastructure as code is great but AWS Cloudformation is not! Learn why JSON-based Cloudformation is bad and what alternatives exist. Devops ✓ AWS ✗ JSON ✗","findings":0,"id":"jb-cloudformation-sucks","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/aws-cloudformation/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2015-05-21T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-05-21","sections":[{"id":"json-lang-wtf","title":"JSON Lang, WTF?!","url":"https://www.janbrennenstuhl.eu/aws-cloudformation/#json-lang-wtf"},{"id":"cfn-sphere","title":"CFN-Sphere","url":"https://www.janbrennenstuhl.eu/aws-cloudformation/#cfn-sphere"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/cloudformation-sucks/index.md","status":"published","title":"Abusing JSON: Why AWS CloudFormation sucks?!","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/python-tuples-to-dict/","claim":"With docopt you can turn a comma-separated option such as key1.value1,key1.value2 into a dictionary of lists by splitting it into tuples and collecting them in a defaultdict(list).","content_hash":"sha256:a43ae2aff50efcb71210bafef2b741fc42a1cdc0ca0dc7fd7e33865ac14cc788","description":"Python Docopt: How to convert a list of tuples into a dictionary in Python. A quick and easy solution for beautiful command-line interfaces …","findings":0,"id":"jb-python-tuple-list-to-dict","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/python-tuples-to-dict/index.md","modified":"2023-04-15T00:00:00+02:00","published":"2015-04-28T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-04-28","sections":[],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/python-tuple-list-to-dict/index.md","status":"published","title":"Python Docopt: Convert Tuple List to Dictionary","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/svn-to-git/","claim":"You can migrate an SVN repository to Git with its full history and authors by extracting the SVN authors into an authors file and running git svn clone -A authors.txt.","content_hash":"sha256:15dd40b1e40d18d951bd7c393bb42c03085eac8aa59fc9aa500f777365b5217a","description":"Version Control System (VCS) Migration: A short guide on how to migrate SVN to GIT while preserving source code authors and commit history.","findings":0,"id":"jb-svn-to-git","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/svn-to-git/index.md","modified":"2025-06-01T00:00:00+02:00","published":"2015-04-15T00:00:00+02:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-04-15","sections":[{"id":"converting-svn-to-git-w-history--authors","title":"Converting SVN to GIT w/ History \u0026 Authors","url":"https://www.janbrennenstuhl.eu/svn-to-git/#converting-svn-to-git-w-history--authors"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/svn-to-git/index.md","status":"published","title":"How to Migrate SVN to GIT with History?","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/github-license-checker/","claim":"Github-Licker is a small Python command-line tool that uses the GitHub Licenses API to list the licenses of an organization's repositories and find repositories without a license file.","content_hash":"sha256:307fc4efb5dfa05fa0558172207bcf7a2f401ec031b5c03c3c92b529c31a3343","description":"Github Licker is a Github License Checker command line tool that helps you to keep an overview over your organisations OSS licenses. Try it out now!","findings":0,"id":"jb-github-licker","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/github-license-checker/index.md","modified":"2017-04-17T00:00:00+02:00","published":"2015-03-25T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-03-25","sections":[{"id":"github--licenses","title":"Github \u0026 Licenses","url":"https://www.janbrennenstuhl.eu/github-license-checker/#github--licenses"},{"id":"github-license-checker","title":"Github License Checker","url":"https://www.janbrennenstuhl.eu/github-license-checker/#github-license-checker"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/github-licker/index.md","status":"published","title":"How to Check Github Licenses","topics":["engineering-practice"]},{"author":"Jan Brennenstuhl","canonical_url":"https://www.janbrennenstuhl.eu/aws-cloud-immune-system/","claim":"AWS Monocyte finds and deletes AWS resources in regions outside the EU, so companies can let teams run their own accounts and still enforce EU data rules, if only reactively.","content_hash":"sha256:e1a7ecc84745e2a2a732b6cbf6b9094036931b29d444e30d07f255e8df832265","description":"Monocyte: A AWS Immune System. Comply to EU regulations by finding and deleting AWS resources in regions outside of Europe with AWS Monocyte!","findings":0,"id":"jb-monocyte","kind":"essay","license":{"name":"CC BY 4.0","scope":"Original text; credited third-party media retain their own rights.","url":"https://creativecommons.org/licenses/by/4.0/"},"markdown_url":"https://www.janbrennenstuhl.eu/aws-cloud-immune-system/index.md","modified":"2025-06-22T00:00:00+02:00","published":"2015-03-18T00:00:00+01:00","review_basis":"publication","review_status":"reviewed","reviewed":"2015-03-18","sections":[{"id":"aws--ybiyri","title":"AWS \u0026 YBIYRI","url":"https://www.janbrennenstuhl.eu/aws-cloud-immune-system/#aws--ybiyri"},{"id":"a-cloud-immune-system","title":"A Cloud Immune System","url":"https://www.janbrennenstuhl.eu/aws-cloud-immune-system/#a-cloud-immune-system"}],"series":"","source_revision":"a76ce5071ac17d87e2df5e6d9f93b3279043b8d4","source_url":"https://github.com/jbspeakr/janbrennenstuhl.eu/blob/a76ce5071ac17d87e2df5e6d9f93b3279043b8d4/content/post/monocyte/index.md","status":"published","title":"AWS Monocyte: Let's Build a Cloud Immune System","topics":["engineering-practice"]}],"license":"https://creativecommons.org/licenses/by/4.0/","llms":"https://www.janbrennenstuhl.eu/llms.txt","schema_version":"1.2","site":"https://www.janbrennenstuhl.eu/","title":"Brennenstuhl on Security","topics":[{"description":"Building software with coding agents, and giving agents scoped, revocable authority over the tools they use.","id":"agentic-engineering","title":"Agentic Engineering","url":"https://www.janbrennenstuhl.eu/topics/agentic-engineering/"},{"description":"OpenID Connect, OAuth, passkeys and step-up: who is acting, on whose behalf, and how strongly that was proven.","id":"identity-authentication","title":"Identity \u0026 Auth","url":"https://www.janbrennenstuhl.eu/topics/identity-authentication/"},{"description":"Secure defaults, platform-level controls and the attacks they have to hold against, from phishing to supply chains.","id":"application-security","title":"AppSec","url":"https://www.janbrennenstuhl.eu/topics/application-security/"},{"description":"Password policies that people can follow, systems that do not punish password managers, and the attacks on reused credentials.","id":"passwords","title":"Passwords","url":"https://www.janbrennenstuhl.eu/topics/passwords/"},{"description":"JSON Web Tokens and the JOSE family: what tokens are for, how they are signed, encrypted and verified, and where they go wrong.","id":"tokens-jwt","title":"Tokens \u0026 JWT","url":"https://www.janbrennenstuhl.eu/topics/tokens-jwt/"},{"description":"Notes from running software: cloud infrastructure, European hosting, tooling and the occasional migration.","id":"engineering-practice","title":"Engineering Practice","url":"https://www.janbrennenstuhl.eu/topics/engineering-practice/"}]}