December 21, 2015 by P.I.E. Staff

A year-in-review blog post about our projects at Paragon Initiative Enterprises.

December 20, 2015 by Scott Arciszewski

Or: How I learned to stop worrying and love software exploitation.

December 15, 2015 by P.I.E. Staff

There are three forms of dishonesty: Lies, damned lies, and security trade-offs.

November 15, 2015 by P.I.E. Staff

If you're wondering which cryptography library you should use in your project, this should help make the decision easier.

November 7, 2015 by Scott Arciszewski

Preventing side-channel attacks (i.e. timing attacks on MAC validation) and dangerous compiler optimizations with a blinded comparison.

October 27, 2015 by P.I.E. Staff

The theory and practice of securing file upload form handlers. Our examples are in PHP, but many of the filesystem security concepts here are language agnostic.

October 9, 2015 by Scott Arciszewski

In version 4.4 and on, WordPress's random number generator function (wp_rand) will now be cryptographically secure.

September 21, 2015 by P.I.E. Staff

Don't just fix security vulnerabilities, prevent the habits that cause them in the first place.

September 11, 2015 by P.I.E. Staff

If you ever wondered the best way to encrypt a username or row ID for an obfuscated URL in PHP, this is the article for you.

September 9, 2015 by Scott Arciszewski

No matter what language you're developing in, there's really only one cryptography library that shines above the rest.

September 5, 2015 by P.I.E. Staff

With PHP 7 nearing its official release, let's reflect on the state of cryptography in PHP applications.

August 15, 2015 by Scott Arciszewski

We aren't satisfied with the industry's current attempts to teach the basic concepts of application security to software developers; instead, we propose a gentler model.

August 7, 2015 by P.I.E. Staff

A human-readable overview of commonly misused cryptography terms and fundamental concepts.

July 19, 2015 by P.I.E. Staff

Some useful things that can be built with a CSPRNG.

July 6, 2015 by P.I.E. Staff

A lesson on cryptographically secure pseudorandom number generators in PHP, and how to generate random integers and strings from a high quality entropy source like /dev/urandom to generate secure random passwords in PHP.

June 27, 2015 by P.I.E. Staff

What is the potential impact of a given vulnerability? This isn't easy to answer.

June 16, 2015 by P.I.E. Staff

Although Cross-Site Scripting is one of the most common vulnerabilities on the Internet, it remains an unsolved problem (unlike SQL Injection).

June 15, 2015 by P.I.E. Staff

There are a lot of ways having an online presence can be used against you, and the most basic security decisions are not technical.

June 4, 2015 by P.I.E. Staff

The first in a two-part series. We establish a mathematical definition for popularity within a given dataset and build some abuse resistance into the algorithm design.

May 26, 2015 by P.I.E. Staff

It's 2015; there's no excuse for writing code vulnerable to SQL Injection any more

May 14, 2015 by P.I.E. Staff

Alternative title: "Libmcrypt considered harmful." You should use libsodium if you can, or OpenSSL if you can't.

May 12, 2015 by P.I.E. Staff

We're maintaining a curated appsec reading list on Github -- check it out.

May 5, 2015 by P.I.E. Staff

A developer's short guide to encryption, authentication, and authenticated encryption with examples in PHP

April 21, 2015 by P.I.E. Staff

Login forms with a remember me checkbox are a common requirement. We explore the security of login forms and a robust model for remember me checkboxes.

April 17, 2015 by P.I.E. Staff

How to configure and use PHP's build-in session management system for maximum security.

April 17, 2015 by P.I.E. Staff

The official release of the PHAR auditing utility by Paragon Initiative.

April 15, 2015 by P.I.E. Staff

Secure code delivery is a hard problem; one which we aspire to solve.