Unmitigated Risk
Essays by Ryan Hurst on security design, the WebPKI, compliance, and AI.
- Posts
- 378 from 6 Dec 2006 to 28 Oct 2026
- Posting
- weekly (45 in the last year)
- Kind
- personal blog
- Feed
- https://unmitigatedrisk.com/rss.xml
2026 42
- Agents Should Earn Authority, Not Inherit It
- The WebPKI's Unmanaged Software Supply Chain
- Trusted Everywhere, Impact Everywhere
- The Private Key Was Four
- Rejection Is Not a Verdict
- The Amnesia Cycle and Why AI Is Turning Developers Back Into Testers
- Hurst University
- From Periodic Audit to Continuous Assurance
- From Chains to Trees
- The Status Quo Outlived Its Status
- Why FIPS 140 Means Running Old Code
- The Certification Ends Where the Code Begins
- Steve Jobs, AI, and the Problem of Analysis Without Ownership
- The Breaker, the Priest, and the Philosopher
- The Prompt Is an Argument
- The Prompt Is the Meaning
- A CA That Produces Evidence, Not Promises
- A CA Built for the Threat Model We Actually Have
- The First AI-Built Zero-Day Is Not the Interesting Part
- AI Is Not Why They Are Cutting (Yet)
- Smaller, Provable, and on Hardware You Own and Operate
- The Illusion of Constant Acceleration
- Confidential Computing's Inconvenient Truth
- What Is Confidential Computing, What It Isn't, and How to Think About It
- Why Nobody Can Verify What Booted Your Server
- We Built It With Slide Rules. Then We Forgot How.
- The WebPKI and Client Authentication Are at a Crossroads
- Introducing the WebPKI Observatory
- Signed, Auditable, Offline-Tolerant, PQ Secure QR Codes
- When Compliance Records Become the Only Honest Signal
- The Signal They Chose to Ignore
- Duplicates Are Not the Problem
- Teach to the Median, Punish the Variance
- The Data Doesn't Support the Narrative
- When Building Gets Cheap, Distribution Becomes Destiny
- Domain Control Validation Grew Up. It Only Took Thirty Years.
- Disdain or Design?
- You're Not Outsourcing Infrastructure. You're Outsourcing Capability.
- Agents Are More Like Humans Than Workloads. Here's Why That Matters for Identity.
- "A Few Hours" and the Slow Erosion of Auditable Commitments
- The Housing Affordability Crisis
- Intuition Comes Last
2025 55
- The Impossible Equation
- Attestation, What It Really Proves and Why Everyone Is About to Care
- The Vanishing On-Ramp
- Beyond Gutenberg: How AI Is Teaching Us to Think About Thinking
- Compliance at the Speed of Code
- Gradually, Then Suddenly: Compliance as a Vital Sign of Organizational Decay
- Beyond the Mathematics, Deploying Advanced Crypto Successfully
- Another Sleeping Giant: Microsoft’s Root Program and the 1.1.1.1 Certificate Slip
- How Microsoft Code Signing Became Part of a Trust Subversion Toolchain
- From Persistent to Ephemeral: Why AI Agents Need Fresh Identity for Every Mission
- Talent Isn't a Security Strategy
- History Doesn't Repeat, But It Rhymes: The AI Panic Edition
- When Automation Becomes Bureaucracy
- How a $135 Billion Fraud Bootstrapped America's Digital Identity System
- The AI Paradox: Why Building Software is Both Easier and Riskier Than Ever
- Lawyers Think Like Security Engineers. AI Treats Them Like Secretaries
- How Let's Encrypt Changed Everything
- WebPKI Market Analysis: Mozilla Telemetry vs Certificate Transparency Data
- Conway's Law Is Dying
- What Does CPA Canada Have to Do With the WebPKI Anyway?
- The WebPKI's Moral Hazard Problem: When Those Who Decide Don't Pay the Price
- From Mandate to Maybe: The Quiet Unwinding of Federal Cybersecurity Policy
- Why CP and CPSs Matter More Than You Think
- Déjà Vu in the WebPKI
- Necessity is the Mother of Invention: Why Constraints Invite Innovation
- Rethinking Compliance: AI, Skill Liquidity, and the Quest for Verifiable Truth
- When AI Injects Liquidity Into Skills: What Happens to the Middle Tier?
- The Rise of the Accidental Insider and the AI Attacker
- Agents, Not Browsers: Keeping Time with the Future
- Agents, Not Browsers: The Next Chapter of the Internet
- Crypto agility isn’t a checkbox—it’s an operational mindset.
- How ‘Sneakers’ Predicted Our Quantum Computing Future
- The Strategic Reality of Enterprise Deployment Options
- Strategic Product End-of-Life Decisions
- Decision-making as a Product Manager
- Cloud's Accelerated Evolution: Lessons from Telecom's Century of Change
- Understanding Enterprise Security Buyer Dynamics
- TPMs, TEEs, and Everything In Between: What You Actually Need to Know
- Operational Evolution Revisited: How AI-Native Systems Will Revolutionize Infrastructure
- Incident Response Done Right: A CA’s Guide to Resilience
- How Organizational Inertia Externalizes Risk in the WebPKI
- From Perimeter to Patterns: Envisioning Security a Decade from Now
- The Fallacy of Alignment: Why AI Safety Needs Structure, Not Hope
- Educating the Champion, the Buyer, and the Market
- The Account Recovery Problem and How Government Standards Might Actually Fix It
- From the Morris Worm to Modern Agentic AI Threats
- From Plato to AI: Why Understanding Matters More Than Information
- Key Management: A Meme Retrospective
- The Identity Paradox: If It’s an Identity, Why Is It in a Secret Manager?
- AI Agent Security Needs Accountability and Control
- How Washington State is Preparing to Undermine Parents and the Constitution
- Why It’s Time to Rethink Machine and Workload Identity: Lessons from User Security
- What Makes a QR Code Verifiable?
- How AI Can Transform Our Broken Healthcare System
- The Laws of Stupidity and the Gaps in Your Security Posture
2024 49
- Safeguarding Internet Trust: From Reactive to Continuous
- Beyond Memorization: Preparing Kids to Thrive in a World of Endless Information
- Technology bias—we all have it—but it often gets in the way.
- Government CAs and the WebPKI: Trust is Often the Opposite of Security
- Another CA Fails the Turing Test?
- Proactive Security: Engineering Resilience from the Ground Up
- From Years to Seconds: Rethinking Public Key Infrastructure
- Bundling and Unbundling in the NHI Market: Opportunities in Identity, Governance, and Cryptography
- Rethinking Authentication: “Something You Have,” “Something You Know,” and “Something You Are” for Workloads and Machines
- The Myth of Non-Technical Product Management
- The Subtle Art of Getting Your Product Deployed
- From Fairways to the Cloud: Estimating Golf Balls in Flight to Tackling Cloud Workload Scale
- Beyond the Facade: Evaluating Long-Term Impacts of Enterprise Software Architectures
- When Words Mislead: Cybersecurity’s Terminology Problem
- The True Essence of Secure by Design
- CA Misissuance: A Tale of Two Incident Responses
- Exploring Requirements for Timelines Certificate Problem Reports and Revocations
- HSMs Largely Protect Keys from Theft Rather Than Abuse
- Turning Catastrophe into Opportunity: Improving Processes and Vendor Accountability
- Reading the Tea Leaves: What Led to the Largest IT Outage in History
- Content is King in Phishing and the Role of Publicly Trusted CAs
- Global Consistency for AKD: Using Armored Witness to Prevent Split Views
- Timeless Farm Wisdom
- Understanding Patterns in WebPKI CA Issues
- Exploring Browser Distrust
- Navigating Public Reporting Obligations in WebPKI and Beyond
- Why We Trust WebPKI Root Certificate Authorities
- Balancing Innovation and Privacy: The Risk of Government Surveillance in the Age of AI
- Speeding Up Development and Navigating Security Risks
- Groundhog Day: Learning from Past Key and Credential Compromises
- Integrating Security: Making Safe Software Development Seamless and Productive
- From Static to Dynamic: Adapting PKI for Cloud-Native Architectures
- Credential Management vs. Secret Management: Choosing the Right Approach
- ACME vs. SPIFFE: Choosing the Right One
- Building Effective Roadmaps through Mission, Vision, and Strategy Alignment
- Transitioning from Reactive to Proactive
- Automating Non-Human Identities: The Future of Production Key Management
- Rethinking Security in Complex Systems
- Navigating Security and Innovation
- The Rebirth of Network Access Protection with Microsoft's Zero Trust DNS
- How TLS Certificates Can Authenticate DNS TXT Records
- Restoring Memories
- Navigating Content Authentication In the Age of Generative AI
- Tenement Farming and Cloud HSMs
- Evolving Challenges in Software Security
- Echoes of the Past and Their Impact on Security Today
- Challenges in Digital Content Authentication and the Persistent Battle Against Fakes
- Gov ID: If at First You Don't Succeed, Try, Try Again
- Rethinking How We Assess Risk in the Software We Rely On
2023 17
- Effortless Certificate Lifecycle Management for S/MIME
- The Rise of Key Transparency and Its Potential Future in Email Security
- Raising the Bar: The Urgent Need for Enhanced Firmware Security and Transparency
- Words matter in cryptography or at least they used to
- Document Authenticity in the Age of Generative AI
- The Scale of Consequence: Storm-0558 vs DigiNotar
- The Evolution and Limitations of Hardware Security Modules
- Towards Greater Accountability: A Proposal for CA Issuance Decision Logs
- Exploring the Potential of Domain Control Notaries for MPDV in WebPKI
- Strengthening Domain Control Verification: The Role of Multiple Perspectives and Collaboration
- Key Management and preparing for the Crypto Apocalypse
- The Growing Security Concerns of Modern Firmware and the Need for Change.
- Global Trend in Tech Regulation and its Consequences for the EU and the US
- The Importance of Proper Measurement in Enterprise IT Management: Lessons from Cloud Deployments
- The Changing Landscape of Internet Protection
- The Limitations of Audits: What You Need to Know
- Using Caddy with Google Trust Services
2022 13
- To err is human, to forgive is divine
- A Boy Scout is always prepared
- Baseline requirements are just that a baseline
- TOFU and the Web
- Top #5 CAs by issuance volume as of 09/19/22
- Why hasn’t SHAKEN/STIR made a big dent in the volume of robocalls?
- User-managed smart cards are an oxymoron
- Getting an EV Code Signing Certificate in 2022
- How to keep bad actors out in open ecosystems
- What would it look like to go back to first principles when it comes to root store management in 2022?
- WebPKI, TLS, cross-signs, device compatibility, and TLS record size.
- Why crawling is not an adequate measurement methodology for the WebPKI
- How to measure the WebPKI ecosystem
2021 6
- Cryptographic controls and feature trade-offs
- Evolution of privacy governance and how cryptographic controls can help
- How is ACME different than XCEP/WSTEP anyway?
- The next decade of Public Key Infrastructure…
- Accountability and Transparency in Modern Systems
- Information system security and how little things have changed
2019 5
2018 4
2017 12
- Positive Trust Indicators and SSL
- Let's talk about revocation checking, let's talk about you and me.
- My response, to his response, to my response? or short-lived certificates part 3
- It is my turn, or short-lived certificates part 2
- How to keep a secret in Windows
- Why bother with short-lived certificates and keys in TLS?
- Revocation reasons don’t make sense for the WebPKI of today
- Secondary effects when encrypting the web
- Digital Signatures and the fallacy of Good, Cheap and Fast.
- CAs and SSL and Phishing Oh My!
- How do you show someone they are important to you?
- Do PDFs have to be so frustrating?
2016 5
2015 21
- The PKCS#12 standard needs another update
- Graphene CLI
- Certificate based Encryption in PDFs
- PKIjs and trust lists
- ECC, NSA and Crypto Agility
- PKCS #11, Javascript and Nodejs
- Paper in a Digital World
- WebCrypto and the modern web app
- Uniform Electronic Legal Material Act and Digital Signatures
- Blockchain, Digital Signatures and Identity
- What makes an enforceable electronic signature?
- The bright side of the dark side
- Help Wanted: Apprentice to learn trade
- Farm boy sensibilities and the importance of contracts
- Removing Friction From Online Signatures
- Wet, Dry, Electronic, Digital and Hybrid Signatures
- Browser Bound Certificates
- A look at short lived certificates, keys and the relevance of FIPS 140-2
- Key management and key lifetime
- My thoughts on Let’s Encrypt
- Has identity verification on the web become a glass ceiling?
2014 35
- 2014
- The first web-server and the meaning of the SSL lock
- What are some upsides of googles’s SHA1 deprecation plan?
- How did I get involved in PKI?
- What will Chrome’s SHA1 early warning look like?
- Smart cards, PC/SC and Chrome
- Smart cards, PIV, Bitcoin and secp256k1
- Verifying a Bitcoin Wallet Address Tutorial
- Two Factor Authentication with BitGo and Coinbase
- Cupid and Understanding Your Exposure
- Bitcoin adoption in payments
- Bitcoin and the credit card ecosystem
- Proving assets under management is important but it is not an audit
- Liquidity risk and management in Bitcoin
- SWIFT, CHIPS, ACH, Fedwire and Bitcoin…
- Beyond Builders, Defenders, and Breakers
- Attacker Mind Map for Bitcoin
- A Bitcoin Risks Mind Map
- Hardware Based Key Management and Bitcoin
- If you don’t hold it, you don’t own it
- Effectiveness of security controls in physical security
- PiperWallet First Impressions
- Verifying a Bitcoin Wallet Address
- Certificate Path Building in PKIjs
- MUST STAPLE and PKI.js
- Generating signed messages using CMS and PKI.js
- Frankencerts, new extensions and PKI.js
- Potential projects for PKI.JS
- WebCrypto and PKI
- The bias of experience and ignorance of youth
- Bitcoin Paper Wallets and Digital Backups
- Keeping long-term passwords secured
- Protecting Bitcoin keys with hardware
- Keeping an eye on your Bitcoin keys
- Insurance and Bitcoin
2013 31
- What's in a certificate chain and why?
- How to generate and send a timestamp request for Authenticode
- How to generate and send an RFC3161 timestamp with OpenSSL and curl
- The weaknesses of fingerprint based authentication
- Thoughts on Apple and fingerprint based biometrics
- The origin of the Windows Biometric Framework
- The (soon to be) not-so Common Name
- Strategies for Deploying 2FA
- Windows Certificate Enrollment Protocols
- DCOM and your Firewall
- Enterprise logon with challenge response (OTP) tokens
- How to redirect POST’s based on their Content-Type in Nginx
- Deploying forward secrecy on RedHat, Centos or Fedora based systems
- How to Build Your Own OpenSSL
- Example IIS SSL / TLS configuration
- Deploying SSL – Beyond the certificate and cipher suites
- Deploying SSL – How to get your server configuration right
- How to do a quick and dirty benchmark on a smart card
- How to get the latest stable OpenSSL, Apache and Nginx
- Example Nginx SSL / TLS configuration
- Average CRL size and download time
- How not to collect sensitive information
- A look at revocation repository uptime
- Why we built the Revocation Report
- Certificate-based Mozilla Persona IdP
- Microsoft Root Program and Excel
- Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 2
- Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 1
- Abstract: Using least privileged design principals to improve trust in the online marketplace
- Abstract: Revocation reality and the path to becoming effective
- Is SSL Broken?
2012 74
- SSL 3.0 Usage in the Wild
- Understanding Windows Automatic Root Update
- How Facebook can avoid losing $100M in revenue when they switch to always-on SSL
- Making a Windows smartcard login certificate with OpenSSL.
- Using CAPICOM on Windows x64
- Priming the OCSP cache in Nginx
- What is the status of revocation checking in browsers?
- Revocation checking, Chrome and CRLsets
- A quick look at SSL performance
- Reading ocspreport and crlreport at x509labs.com
- Logo for x509Labs
- RESTful X509, CRL and OCSP to JSON web-service
- A look at revoked certificates
- A look at untrusted certificates
- A look at expired certificates
- How to tell DV and OV certificates apart
- Windows XP and Name Constraints
- Algorithms, key size and digital certificates
- XP and the undefined Name Constraints
- Updated my script for Qualified Subordination testing
- Using ECC keys in X509 certificates
- Using SHA2 based signatures in X509 certificates
- How to get your own OID arc
- Government CAs in the Microsoft Root Program
- Serving OCSP POST responses on a CDN
- Wanted: Senior Software Engineer (Back-End) [Manila]
- Wanted: Senior Software Engineer / Lead [Manila]
- Wanted: IT Analyst [Tokyo]
- Wanted: Information Technology Manager [Tokyo]
- Wanted: Network and System Specialist [Singapore]
- Wanted: Software Engineer [Seattle/Manila]
- Wanted: Senior Software Engineer (Front-End) [Seattle]
- How to seed the CryptoAPI URL cache with an OCSP response
- CryptoAPI, Revocation checking, OCSP and the Unknown certStatus
- Serving OCSP on a CDN
- Using Monitis to monitor OCSP and CRL performance
- Revocation repositories, IPv6 support, message size, and performance
- A revised look at the new Windows Update SSL configuration
- Setting HTTP headers with OpenSSL and the OCSP test client
- Measuring OCSP Responder Performance with Powershell
- Pulse data publicly availible
- A look at the new Windows Update SSL certificates
- What is your organizations policy on SSL?
- Redirecting HTTP to HTTPS in IIS
- Redirecting HTTP to HTTPS in Apache
- Was the Flame WSUS attack caused just because of the use of MD5?
- RSA keys under 1024 bits and you
- Testing OCSP Stapling
- OCSP Stapling in IIS
- OCSP Stapling in Apache
- Flame and Certificate Revocation
- Flame was just one use of the Terminal Services Licensing PKI
- How did the Terminal Services Licensing PKI effect you?
- How one typically verifies code comes from Microsoft
- The tale of two (Microsoft) PKIs
- MSRC 2718704 and the age of the rogue certificates
- MSRC 2718704 and Terminal Services License Certificates
- MSRC 2718704 and Nested EKU enforcement
- MSRC 2718704 and the Terminal Services Licensing Protocol
- Getting beyond 1% -- How do we increase the use of SSL?
- Lightning talk on the “Improving the Availability of Revocation Information” workshop.
- Transcript for Panel on Third-Party Trust Providers and SSL Best Practices
- Always On SSL (AOSSL) Whitepaper Published
- My top PKI/TLS related issues in Firefox
- Attending workshop on “Improving the Availability of Revocation Information”
- Browser Revocation Behavior Needs Improvement
- OCSP Responder Performance Needs Improvement
- How to do OCSP requests using OpenSSL and CURL
- Hard revocation checking and why it’s not here yet.
- Using OpenSSL to create a test Qualified Subordination PKI hierarchy
- Least Privilege and Subordinate Certificate Authorities
- SSL/TLS Deployment Best Practices
- My first post since joining GlobalSign
- Leaving Microsoft, My Goodbye Letter