A prompt starts appearing on your Mac, and it looks like pure convenience: Touch ID, a saved login, one less password. But the prompt is only the surface. Underneath it is a public/private-key signing ceremony, and the useful way to read a passkey is not as a prettier password box but as a per-site signing credential. A password is a shared secret you hand over and the server checks; a passkey is a signature the device produces and the server can only verify. That one change, from presenting a secret to proving control of a private key, is what defeats phishing, replay, and database theft, and it is why a stolen server database yields no logins at all. This is a close reading of the whole ceremony, registration through verification, built from a Python lab that traces every byte: what gets signed, what each side stores, and exactly which check catches each attack.
Writing
Essays, papers, notes, and references.
A place for longer pieces, formal work, and useful written records.
A prompt starts appearing on your Mac, and it looks like pure convenience: Touch ID, a saved login, one less password. But the prompt is only the surface. Underneath it is a public/private-key signing ceremony, and the useful way to read a passkey is not as a prettier password box but as a per-site signing credential. A password is a shared secret you hand over and the server checks; a passkey is a signature the device produces and the server can only verify. That one change, from presenting a secret to proving control of a private key, is what defeats phishing, replay, and database theft, and it is why a stolen server database yields no logins at all. This is a close reading of the whole ceremony, registration through verification, built from a Python lab that traces every byte: what gets signed, what each side stores, and exactly which check catches each attack.
Building Automation Systems are the silent brains of modern buildings: HVAC, lighting, access control, lifts, energy management. Designed for reliability, they were quietly connected to the internet and the wider IoT estate, and every new connection widened the attack surface. This piece walks through how BAS became a soft target: open protocols that trust by default, real incidents that exploited overlooked vulnerabilities, and the uncomfortable truth that a comfort system can become a way into the corporate network. It covers why these systems are so exposed, long lifecycles, weak segmentation, vendors optimising for uptime over hardening, and what defence actually requires: visibility, segmentation, and treating the physical integrity of a building as a security concern, not just its data. The threat is invisible because the systems are.
TLS and centralised Public Key Infrastructure were built for the web, humans connecting to servers, not for fleets of machines talking continuously with no human in the loop. As Industrial IoT scales to millions of devices, traditional PKI strains: certificate authorities become single points of failure, revocation is slow, and one compromised node can threaten the whole system. This piece makes the case for Brontide, the Lightning Network's encrypted handshake, as a better fit for machine-to-machine communication: decentralised trust, channel graphs standing in for certificate authorities, and identity backed by economic stake rather than a single signing party. It walks through the limits of conventional PKI at industrial scale, how Brontide and Instant Karma PKI reframe the problem, and why borrowing trust from a payments network might be what securing industrial machines needs.