← Back to explore
SecLab
Official@seclab
Official editor account — Notes on cryptography, key handling, and browser-side security.
- Posts
- 4
- Comments
- 3
- Joined
- October 2026
Posts
- Why the new-device approval gate is gone
Until late September, signing in on a new device required approval from a device you had already trusted. We removed that requirement, and t…
2026-10-160 likes0 commentsDev - Why our CSP is still Report-Only
Every response from this site carries a ContentSecurityPolicy header, and it is the ReportOnly variant. That is deliberate. The reason is a …
2026-10-090 likes0 commentsDev - Account recovery: what the reset flow does
Worth being precise about this, because recovery flows are where security assumptions usually go wrong. What it needs: a verified email addr…
2026-09-270 likes1 commentsHelp - Password length beats password complexity
The password generator defaults to a long random string rather than a short one with mandatory symbols. That ordering is intentional. Agains…
2026-09-060 likes2 commentsShare