Scott Helme

  1. Device Bound Session Credentials lands in Chrome on macOS

    Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer token that works anywhere it's pasted, DBSC binds the session to a private key that lives in your device's hardware and

    Published

  2. Everything I Learned Shipping Device Bound Session Credentials

    We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn't prepare you for.Some caused random logouts. One could deadlock a browser tab indefinitely. Two silently turned a device-bound session…

    Published

  3. Connection Allowlist: a network firewall, built into the browser

    Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open network connections to. Anything not on the list is blocked by the browser before the connection leaves the machine. It's currently a

    Published

  4. Top 1 Million Analysis – June 2026: The State of Crypto

    This is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookies, email and DNS hygiene. This part is the bit I've been most excited to write: a focused look at the

    Published

  5. Top 1 Million Analysis – June 2026: Ten Years of Web Security

    It's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. But there's a much bigger reason to dust off the crawler and publish another report: this

    Published

  6. A dead CDN, a wildcard, and an attack waiting to happen: the netdna-ssl.com takeover

    Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really shouldn't. Last week one jumped out at me: netdna-ssl.com. If you've been around the WordPress world

    Published

  7. Why No Passkeys? Naming the Top Sites That Still Don't Support Them

    Back in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check which ones still weren't redirecting visitors to HTTPS, and put the laggards on a list for everyone to see. No lecture,

    Published

  8. The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students

    A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a serious security incident when it is rendered inside privileged internal tooling. This was not an exotic attack chain; it was stored XSS, over-scoped access…

    Published

  9. Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP

    We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful. It's MIT-licensed, pure-PHP, and available on Packagist now!What is DBSC?If you'd

    Published

  10. DBSC Beta at Report URI

    This week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers and reduce the damage caused by stolen cookies. Today, we're announcing the beta of DBSC at Report URI!Device Bound Session CredentialsYou should definitely

    Published

  11. Device Bound Session Credentials: Making Stolen Cookies Useless

    A stolen session cookie can be vastly more powerful than a stolen password. The attacker doesn’t need to phish the user, bypass MFA, or defeat their passkey; they simply replay the cookie and step straight into a fully authenticated session. That’s why info-stealers love browser

    Published

  12. Passkeys, Permissions Policy and Bug Hunting in 1Password's WebAuthn Wrapper

    Passkeys are the best thing to happen to web authentication in years, but a passkey ceremony is only as secure as the stack enforcing it. The browser, the relying party, the authenticator, and any extension sitting between them all need to honour the same rules.While investigating WebAuthn behaviour…

    Published

  13. Open-Sourcing passkeys-php: A Security-Focused WebAuthn Library for PHP

    We've open-sourced passkeys-php, the WebAuthn server library we use at Report URI to protect logins with passkeys, security keys, and platform authenticators like Touch ID, Face ID, and Windows Hello.It started as a set of local security fixes for our own production passkeys implementation. Now,

    Published

  14. XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None

    A single XSS vulnerability can turn passkeys from a phishing-resistant login mechanism into a persistent account takeover backdoor. If malicious JavaScript can run on your page, it may be able to register an attacker-controlled passkey against the victim’s account. The user sees nothing, the website…

    Published

  15. Passkeys 101: An Introduction to Passkeys and How They Work

    Passwords have been the weak point in online authentication for decades. They can be reused, guessed, stolen, phished, leaked, sprayed, stuffed, and captured by malware. Passkeys are one of the first mainstream authentication technologies that remove many of those problems entirely, and any website still…

    Published