Security
Security work, with the evidence
I’ve been building apps with security requirements since 2015. Lately I read the standards too, and tell NIST what developers need from them.
-
One Medical authentication bypass
Found, reported and confirmed: returning from the background, failed Face ID attempts still flashed the app’s last private screen.
-
Four comments to NIST
OSCAL, the National Checklist Program, the SSDF, and AI for CSF analysis.
-
Beyond the Sandbox: Secure iOS Development in an Era of New Security Standards
Secure iOS development and OWASP’s mobile standards (MASVS/MASTG), in the context of NIST and ISO 27001.
-
Code to Avert Catastrophe
Demos the One Medical authentication bypass (from 11:06).
-
Gatorade Gx
Handled sensitive user health data from HealthKit in Gatorade’s sports-science app.
-
Wickr Messenger
Refactored authentication for Face ID in an encrypted messenger used in high-security settings.
-
Wegmans + Apple Wallet
Public/private key-pair generation for NFC Wallet passes at the iOS 9 launch.
Secure Code Showdown
Won Secure Code Warrior’s Secure Code Showdown at the OWASP NYC Hackfest, AWS New York.