Top all-time · #922
Paragon Initiative
Company blog · paragonie.com/blog · on HN as paragon_initsecurityprogramming
Paragon Initiative is the company blog at paragonie.com, writing about security and programming. Since 2015, 73 different Hacker News readers have linked it 491 times, most often “JSON Web Tokens should be avoided”. It has a working feed you can follow.
Too few sampled comments (28) to say how often HN recommends it.?
Why HN links it
HN readers link Paragon Initiative's blog as reference material on web security, especially JWT, password storage, PHP security and crypto. Commenters cite its posts to back their own points.
Summarised by Claude from a sample of 28 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Security expertise for hire. Technology consulting. Application security above and beyond compliance. PHP security. Applied cryptography. Secure-by-default web application development. Encryption, digital signatures, authentication protocols, and more.
Most-linked posts?
- JSON Web Tokens should be avoided20 people · 30 mentions · first linked 2017-03-14
- How to Safely Store Your Users' Passwords in 20167 people · 10 mentions · first linked 2016-02-15
- The 2018 Guide to Building Secure PHP Software5 people · 8 mentions · first linked 2017-12-12
- Paseto Is a Secure Alternative to the JOSE Standards (JWT, Etc.)5 people · 7 mentions · first linked 2018-03-04
- Basic Cryptography Concepts for Developers4 people · 13 mentions · first linked 2015-08-07
- On the Design and Implementation of a Stealth Backdoor for Web Applications4 people · 10 mentions · first linked 2016-01-04
- Libsodium Quick Reference4 people · 9 mentions · first linked 2017-06-10
- Encryption is not Authentication, a Primer4 people · 8 mentions · first linked 2015-05-05
- Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)4 people · 6 mentions · first linked 2018-08-23
- Split Tokens: Token-Based Authentication Protocols Without Side-Channels4 people · 4 mentions · first linked 2017-02-28
What Hacker News says?
It's still quite impractical, m sure with some quantum computer or a custom ASIC built by those "super nerds" at the NSA its possible but but for you general adversary aka "hackers" (skiddies IMHO) it will be infeasible. What this means is for all of you [developers], is to start new projects without SHA1 and plan on migrating old ones (if it's totally necessary, normally don't unless you use SHA1 for passwords). A…
Comment linking /blog/2016/02/how-safely-store-password-in-2016
on “Announcing the first SHA-1 collision”Submitted How to Safely Store Your Users' Passwords in 2016 as a story · 479 points
HN discussionThis line of discussion ("Make it so we can pay you $xxK/mo, don't ask for donations.") comes up a lot on HN. Here's what I did: First, I spent four years developing security libraries for PHP developers that can be considered core infrastructure. Random_compat was an API-compatible polyfill of PHP 7's random_bytes() and random_int() functions for PHP 5 projects (and has over 100 million downloads). sodium_compat re…
Comment linking /enterprise
on “GitHub Sponsors”Submitted JSON Web Tokens should be avoided as a story · 386 points
HN discussionLet's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…
Comment linking /white-paper/2015-secure-php-data-encryption
on “Let's Encrypt is Trusted”Submitted How to Generate Secure Random Numbers in Various Programming Languages as a story · 245 points
HN discussionIf anyone else has screwed up and used MD5 for passwords and doesn't know a good way to migrate towards something secure: https://paragonie.com/blog/2016/02/how-safely-store-password...
Comment linking /blog/2016/02/how-safely-store-password-in-2016
on “Yahoo discloses hack of 1B accounts”Submitted Javascript Object Signing and Encryption is a Bad Standard (2017) as a story · 173 points
HN discussionLet me back this comment up with some reading material and useful resources: http://decentsecurity.com/about/ (This entire website) https://www.microsoft.com/emet (for Windows) https://paragonie.com/blog/2015/06/guide-securing-your-busin... (basic web security advice for non-technical people) You don't need AntiVirus.
Comment linking /blog/2015/06/guide-securing-your-business-s-online-presence-for-non-experts
on “TrendMicro Node.js HTTP server listening on localhost can execute commands”Submitted Simply Secure PHP Cryptography as a story · 147 points
HN discussionAs a consultant for a company[1] that provide code auditing services, I welcome third-party scrutiny for the open source libraries[2] we produce. [1] https://paragonie.com [2] https://github.com/paragonie
Comment linking /
on “TrendMicro Node.js HTTP server listening on localhost can execute commands”Submitted Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past as a story · 139 points
HN discussionAs a webserver: You don't. If the client is owned, that's not the server's problem. Related: https://paragonie.com/blog/2016/03/client-authenticity-is-no...
Comment linking /blog/2016/03/client-authenticity-is-not-server-s-problem
on “The “Cobra Effect” that is disabling paste on password fields”Submitted 2019 Guide to Cryptographic Key Sizes and Algorithm Recommendations as a story · 126 points
HN discussionThis doesn't solve the problem. At all. A checksum is NOT a substitute for a digital signature. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
Comment linking /blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded
on “Transmission BitTorrent app contained malware”Submitted Cryptographically Secure PHP Development as a story · 114 points
HN discussionPlease excuse me if this comes across as anything other than constructive criticism, but I don't believe checklists should be used to guide web developers to build secure software. My reason for this belief is that, in my experience, it engenders tunnel vision and what I appropriately refer to as a "checklist mentality". There are developers who believe, "We're immune to the items on the OWASP Top 10, so we're secur…
Comment linking /blog/2015/08/gentle-introduction-application-security
on “A practical security guide for web developers”Submitted WordPress 5.2: Mitigating Supply-Chain Attacks as a story · 107 points
HN discussion> I would argue the Merkle tree (or any other recursive signature algorithm) A Merkle tree is not a recursive signature algorithm, because a hash function is not a signature algorithm. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass... (Yes, you can build signature algorithms out of hash functions, but definitions matter.)
Comment linking /blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded
on ““We already store data. In a database. It works well””Submitted JavaScript Object Signing and Encryption is a bad standard (2017) as a story · 84 points
HN discussion> Actually, Git is technically a blockchain. No. You can say that git reduces to a Merkle tree. And blockchains use Merkle trees. But you can't say that git is a blockchain. https://gist.github.com/joepie91/e49d2bdc9dfec4adc9da8a8434f... https://paragonie.com/blog/2017/07/chronicle-will-make-you-q...
Comment linking /blog/2017/07/chronicle-will-make-you-question-need-for-blockchain-technology
on ““We already store data. In a database. It works well””Submitted Solving Open Source Supply Chain Security for the PHP Ecosystem as a story · 80 points
HN discussion> If I have your key, I can send you an encrypted GPG message, without you needing to know who am, or for any kind of message from you back to me. HMACs require a shared secret. No, they don't. I described a naive RSA+AES hybrid cryptosystem here that includes HMAC authentication without a pre-shared key: https://paragonie.com/blog/2018/04/protecting-rsa-based-prot...
Comment linking /blog/2018/04/protecting-rsa-based-protocols-against-adaptive-chosen-ciphertext-attacks
on “EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME”Submitted Basic Cryptography Concepts for Developers as a story · 62 points
HN discussionThis might be a better starting point: https://paragonie.com/blog/2017/06/libsodium-quick-reference...
Comment linking /blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use
on “RSA is a fragile cryptosystem”Submitted Building Searchable Encrypted Databases with PHP and SQL as a story · 59 points
HN discussionThese two articles might help: https://paragonie.com/blog/2019/03/definitive-2019-guide-cry... https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
Comment linking /blog/2019/03/definitive-2019-guide-cryptographic-key-sizes-and-algorithm-recommendations
on “RSA is a fragile cryptosystem”Submitted Using Encryption and Authentication Correctly as a story · 49 points
HN discussionI'm a developer, not a cryptographer, and like most crypto articles, most of this post is gibberish to me. I really tried to follow it in the beginning, but then I gave up, scrolled to the "what should you use instead", and then realized I didn't understand that either. If this is article is "easy" crypto, and I shouldn't roll my own crypto, then what should I do? "Just use elliptic curve crypto but make sure you ch…
Comment linking /blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use
on “RSA is a fragile cryptosystem”Submitted Preventing Timing Attacks on String Comparison with Double HMAC Strategy (2015) as a story · 35 points
HN discussion
