Primary Domain
Security
Within the Primary Domain facet, Security intelligence groups reporting by primary domain so readers can follow a focused area of internet infrastructure, governance, connectivity markets, or digital capital. The page brings together related articles, public evidence, institutions, companies, people, regional exposure, operating dependencies, and market context that may otherwise sit across separate category pages. It explains the domain, the likely actor class, the market or governance context, and the source material readers should use when comparing signals. Operators, analysts, and governance readers can see how the same domain appears across events, profiles, market shifts, public-source evidence, regional dependencies, and longer-cycle infrastructure decisions over time.
CASE FILE
The Authorization Conversation Was Still Pending. It Was Not an API Right: GNAP’s Continuation Boundary
A client can be entitled to continue an authorization conversation without being entitled to call the API it asked about. RFC 9635 makes the distinction unusually explicit: a continuation credential advances one grant request at the authorization server; a resource right appears…
IETF
Sean Turner and the Private-Key Proof That Did Not Authorize a Certificate
A certification request can carry a valid signature and still have no right to become the certificate it asks for. The signature answers a narrow question about a key; identity, namespace entitlement, intermediary action and issuance remain separate decisions.
IETF
Panos Kampanakis and the SSH Session with Three Different Security Receipts
An SSH client can negotiate a hybrid ML-KEM key exchange, verify the server through a conventional host key, and admit a user through a still separate credential. The session is one connection; the evidence is not one claim.
IETF
Bas Westerbaan and the Hybrid TLS Handshake That Did Not Make the Certificate Post-Quantum
A browser can report `X25519MLKEM768`, derive a session secret from classical and post-quantum components, and still authenticate the server with a classical certificate signature. Both observations can be true in the same TLS 1.3 connection. Calling the whole service…
IETF
Daniel Fett and the QR Context That MFA Never Authenticated
The password was right, the second factor was real and the authorization server behaved as designed. The attacker still received the session, because the ceremony proved who the user was without proving whose request the user had approved.
CASE FILE
The Certificate Verified the Peer. The External PSK Still Needed a Custodian: RFC 9973 and TLS Authority
A security review can make an unusually comforting statement: the client validated the certificate, the server selected an external pre-shared key, the handshake finished, and the traffic was encrypted. Every clause may be true. None answers the question a security owner…
CASE FILE
A Cookie Matched the Request. It Did Not Prove the Decision: RFC 10025 and Ambient Authority
A browser can attach the right-looking cookie to the right-looking request at the exact moment a consequential button is pressed. That still leaves four questions open: who caused the request, whether the server still accepts the session, whether this action is allowed now, and…
CASE FILE
A Ciphertext Reached the Key. It Did Not Name Its Sender: RFC 9180 and the Authority Missing from HPKE Base Mode
A team can receive an HPKE ciphertext, open it with the intended private key and still be unable to say who sent it, what outer request it belonged to, whether it is fresh, or whether anyone was entitled to act on its plaintext. RFC 9180 makes the cryptographic transition…
CASE FILE
The Packet Declared a Haptic Effect. The Device Still Had to Decide Whether to Render It: RFC 9993
A remote session marks one haptic unit as high priority. The packet is valid, the stream is negotiated and the receiver can decode it. None of that tells an actuator where on a body it may act, whether the requested amplitude is within the device’s envelope, whether a temperature…
CASE FILE
The Domain Requested the Failure Report. The Receiver Still Had to Authorize Disclosure: RFC 9991 and DMARC Forensics
A mail receiver detects a genuine authentication failure in a forwarded calendar invitation. The author's domain has requested a forensic report at an external address. Sending the report could expose the invitation, its recipients and the forwarding path to a party that never…
IETF
Russ Housley and the MAC Address a Certificate Could Name but Not Make Unique
Six bytes can fit cleanly inside a certificate. The difficult part begins after they leave it: who assigned them, what interface is using them now, who observed that use, and why a local network should permit an action.
IETF
Aaron Parecki and the BFF That Stops Token Theft but Not Client Hijacking
Putting OAuth tokens behind a server is a material security improvement. It is not the end of the authorization story. RFC 10017 shows why: malicious browser code may be unable to steal a token and still be able to spend the user’s live session through the same Backend for…
IETF
Hannes Tschofenig and the Authority ID That Was Not the Token Signer
A measured component can name the key that signed its firmware and still say nothing about the key that signed the enclosing attestation token. RFC 10013 makes that boundary explicit. The identifier, the measurement, the EAT signature and the relying party’s decision are four…
CASE FILE
The Envelope Named the Evidence. It Did Not Bind the Device: RFC 9999 and the Authority Inside an Attestation Collection
A server can present signed reports from its CPU, SmartNIC and accelerator in one neat package. The package may be well typed, easy to route and validly encoded while still failing the question that matters: do all three reports describe this device, in this appraisal, under one…
CASE FILE
The Request Signature Survived. The Certificate Could Still Change: RFC 10002 and the Authority Inside CMC
RFC 10002 makes certificate enrolment look less like one approval and more like a chain of bounded decisions. An end entity can sign an intact request, an RA can attest to identity or key possession and request changes in an outer layer, and a CA can apply policy before issuing a…
CASE FILE
The Token Never Reached JavaScript. The Command Still Ran: RFC 10017 and Browser OAuth Authority
RFC 10017 gives sensitive browser applications a clear architectural preference: keep OAuth tokens in a confidential Backend for Frontend. That closes several theft paths. It does not stop hostile code already running in the approved origin from asking the BFF to act. The…
CASE FILE
The Handshake Combined Two Secrets. The Random Generator Was Still One
RFC 10024 gives TLS 1.3 a precise way to combine a traditional exchange with ML-KEM. The construction protects against the failure of one cryptographic assumption; it does not certify that the two components were executed inside independent operational failure domains.
CASE FILE
The Boot Loader Identified Itself. The Relying Party Still Had to Decide
RFC 10013 gives a measured component a portable identity and sampled value inside an Entity Attestation Token. That evidence can be fresh, signed and correctly encoded while the final question — what this device may do — remains unanswered.
CASE FILE
The Login Was Real. The Request Context Wasn't: RFC 10027 and Authority Across Devices
A television asks for an account, a phone displays the authentic service, and strong authentication succeeds. Yet the token can still return to an attacker's device. RFC 10027 makes the missing control visible: the ceremony proved the user, but the unauthenticated path between…
Story
ARIN Accepts Non-Human Service Accounts. Its Guide Still Says to Use an Individual Email
ARIN closed a four-year request on 29 July after removing the account-creation restriction on non-human service accounts. The implementation gives network operators a proper principal for automation. The public instructions have not yet made the same transition: the account guide…