Imposter Syndrome

Published 2025-12-15

Back in August 2023 I received a very odd question from a well-known journalist:

I’m reaching out because I’m investigating some research published last week on LinkedIn. I’m curious if you’d care to speak with me on background about this? https://www.linkedin.com/pulse/rogue-user-account-swapped-microsoft-consumer-keys-lee/

Someone on LinkedIn had discovered that my... [read more]

Reflecting on 10 years of Let's Encrypt

Published 2025-12-03

My friend Christophe Brocas has just published a retrospective on the ten years since we unveiled the ACME protocol to the world. He interviewed me and some colleagues for the piece, and I recommend it! There’s even nice comments on HackerNews, which always makes me smile.

It’s been... [read more]

The State of CRLs Today

Published 2017-08-18

Certificate Revocation Lists (CRLs) are a way for Certificate Authorities to announce to their relying parties (e.g., users validating the certificates) that a Certificate they issued should no longer be trusted. E.g., was revoked.

The end of SHA-1 on the Public Web

Published 2017-02-23

Our deprecation plan for the SHA-1 algorithm in the public Web, first announced in 2015, is drawing to a close. Today a team of researchers from CWI Amsterdam and Google revealed the first practical collision for SHA-1, affirming the insecurity of the algorithm and reinforcing our judgment that... [read more]

Let's Encrypt's Growth to 10 Million Active Unique FQDNs

Published 2016-09-30

Yesterday Let’s Encrypt reached a new milestone: the unique set of all fully-qualified domain names in the currently-unexpired certificates issued by Let’s Encrypt is now 10,022,446.

124 Days of Let's Encrypt

Published 2016-04-05

This is a quick status update from the Early Impacts of Let’s Encrypt post.

Service Assisted Communication and Simplifying a PKI

Published 2014-09-09

Because many of the devices in the IoT are headless and have limited ability to interact with their owners, there needs to be a way to authenticate them without passwords, and without the shortcomings of the existing 0000 and 1234 problems in the Bluetooth world.

Public Authentication

Published 2014-07-30

The public authentication problem is one we have all learned to solve with intuition: How do I decide to trust a new person?

Prevalence of Well Known Peers in the Internet of Things

Published 2014-07-04

The Internet of Things is imagined to be a interconnection of sensors and physical devices of all kinds into the world’s information systems: a collection of machine-to-machine communication devices used to gather and distribute information about the world, contrasted with the human-machine interactions making up the bulk of today’s Internet.... [read more]