Top all-time · #309
Scott Helme
Personal blog · scotthelme.co.uk · on HN as Scott_Helme_securityweb
Scott Helme's personal blog at scotthelme.co.uk covers security and web. Since 2014, 166 different Hacker News readers have linked it 241 times, most often “Are EV certificates worth the paper they're written on?”. It is still writing: the last post was on 2026-10-20, and you can follow it by feed.
Sometimes recommended · 6 of 40 sampled comments recommend it?
Why HN links it
HN readers link Scott Helme's blog as a resource on web security, especially CSP and HTTP security headers, and recommend it for its detailed write-ups.
- Recommended for · 6 comments
- a ton of info; detailed CSP explanation; informative write-up; thorough takedown; a good write-up; a great blog
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hi, I'm Scott Helme, a Security Researcher, Entrepreneur and International Speaker. I'm the creator of Report URI and Security Headers, and I deliver world renowned training on Hacking and Encryption.
Most-linked posts?
- Are EV certificates worth the paper they're written on?5 people · 5 mentions · first linked 2017-12-05
- Revocation is broken5 people · 5 mentions · first linked 2017-07-04
- CSRF is really dead5 people · 5 mentions · first linked 2019-09-06
- An analysis of the Nomx secure communications device5 people · 5 mentions · first linked 2017-04-26
- Using HKPK/HSTS security features to do bad things5 people · 5 mentions · first linked 2016-08-15
- /hpkp-http-public-key-pinning/4 people · 6 mentions · first linked 2015-04-02
- QWAC: The Reincarnation of EV Certificates4 people · 5 mentions · first linked 2022-01-04
- A new security header: Expect-CT4 people · 4 mentions · first linked 2017-03-31
- I'm giving up on HPKP4 people · 4 mentions · first linked 2017-08-24
- The Brand New Security Headers Cloudflare Worker4 people · 4 mentions · first linked 2018-03-19
What Hacker News says?
How was https traffic leaked? Cloudflare, in order to offer its services, acts like a man in the middle and internally decrypts https traffic [0] [0]: https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar...
Comment linking /tls-conundrum-and-leaving-cloudflare/
on “Cloudflare Reverse Proxies Are Dumping Uninitialized Memory”Submitted Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds as a story · 957 points
HN discussion> users are running 5+ year old system CA bundles, which are not sufficient for connecting to some of the most popular API endpoints out there. Really? I was under the impression that when a new CA starts operating, they get their certificates cross-signed by older CAs, to ensure their certificates work on older devices? Lets Encrypt did something like that [1] - although they started operating in ~2015, their certi…
Comment linking /lets-encrypt-old-root-expiration/
on “eMudhra intermediate CA compromise”Submitted Another free CA as an alternative to Let's Encrypt as a story · 736 points
HN discussionThanks to HTTP Public Key Pinning (HPKP), this is no longer a threat: HTTP Public Key Pinning, or HPKP, is a security policy delivered via a HTTP response header much like HSTS and CSP. It allows a host to provide information to a user agent about which cryptographic identities it should accept from the host in the future. This can protect a host website from a security compromise at a Certificate Authority where ro…
Comment linking /hpkp-http-public-key-pinning/
on “Let's Encrypt is Trusted”Submitted Passkeys are not a trap as a story · 677 points
HN discussionStrides have been made in web security, check out the permissions policy[0] along with COOP and COEP[1]. [0] https://www.w3.org/TR/permissions-policy-1/ [1] https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-r...
Comment linking /enabling-coop-and-coep-reports-on-report-uri/
on “Instagram can track anything you do on any website in their in-app browser”Submitted Another free CA as an alternative to Let's Encrypt as a story · 652 points
HN discussionThere's no reason clients couldn't , as far as I know (just like the various anti-spam measures where clients check for records that indicate what servers are allowed to send mail from a domain and consider it spam if those records don't match), but I also don't know of any clients that actually do. And a CAA record still doesn't actively prevent issuance of a certificate, which is really what would be needed. There…
Comment linking /im-giving-up-on-hpkp/
on “eMudhra to exit global SSL/TLS certificate business”Submitted An analysis of the Nomx secure communications device as a story · 379 points
HN discussionI wrote my thoughts on that already: https://scotthelme.co.uk/passkeys-are-not-a-trap/
Comment linking /passkeys-are-not-a-trap/
on “Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds”Submitted Let’s Encrypt to transition to ISRG root as a story · 342 points
HN discussionI have an older blog post that goes in to a little detail on what a CA is and how it works: https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg...
Comment linking /impending-doom-root-ca-expiring-legacy-clients/
on “Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds”Submitted Cross-Site Request Forgery is dead as a story · 320 points
HN discussionI'm just not sure that I can see a world where all devices that rely on TLS/PKI are capable of CT SCT validation. Look at the issues we have around stale root stores still happening when we have validity periods of literally decades. Some of these clients out there simply won't ever be able to keep their trusted log store updated. Refs: Part 1: https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg... Part 2:…
Comment linking /lets-encrypt-postpone-isrg-root-transition/
on “Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds”Submitted CSRF is really dead as a story · 313 points
HN discussionGreat article. Somebody else mentioned Scott Helme, but didn't link to three of his amazing sites: https://securityheaders.com which checks important headers https://report-uri.com/ which allows sending CSP reports to to catch errors. It also has a CSP builder (among a bunch of tools) which is hugely helpful: https://report-uri.com/home/generate https://scotthelme.co.uk/ is his blog with a ton of info. It also has a…
Comment linking /csp-cheat-sheet/
on “HTTP headers for the responsible developer”Submitted Protecting sites from Cryptojacking with CSP and SRI as a story · 237 points
HN discussionI have been trying to explain the importance of HTTP headers to some younger/junior devs I am working with. I have noticed that headers are often considered to be 'too technical' or even 'old tech'. I'm going to recommend them to read this, but I do think I need to explain a couple of things that the article is not clear about: - Be sure that you understand the concept of HSTS! Simply copy/pasting the example from t…
Comment linking /tag/hsts-preload/
on “HTTP headers for the responsible developer”Submitted The Impending Doom of Expiring Root CAs and Legacy Clients as a story · 234 points
HN discussion"Like FLoC and Privacy Sandbox before it, Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks." Thank you to the author for getting to the point: conflict of interest. Google cannot represent ("protect") users and sell to advertisers at the same time. No amount of blog posts/marketing…
Comment linking /what-the-floc/
on “Chrome users beware: Manifest v3 is deceitful and threatening”Submitted Let's Encrypt's old root certificate is expiring as a story · 195 points
HN discussionsecurityheaders.io is now securityheaders.com https://scotthelme.co.uk/security-headers-is-changing-domain...
Comment linking /security-headers-is-changing-domain-and-branding/
on “HTTP Security Headers – A Complete Guide”Submitted The Power to Revoke Lies with the Certificate Authority as a story · 171 points
HN discussionThis is a good basic overview of the basic headers, but I suggest spending some time on Scott Helme's blog. He runs securityheaders.io, a free service that scans your site, and assigns it a letter grade based on what headers and configurations you've applied. For instance, his explanation of Content Security Policy headers is much more detailed than in the OP's link. https://scotthelme.co.uk/content-security-policy-…
Comment linking /content-security-policy-an-introduction/
on “HTTP Security Headers – A Complete Guide”Submitted I revoked $1M worth of EV certificates as a story · 153 points
HN discussionSome context I think is missing: TFA's author claims to use passkeys for 2FA (and so, not as a password replacement as I think is often implicitly assumed in discussion): > This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism. Source: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd…
Comment linking /xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none/?utm_source=scotthelme.co.uk
on “Passkeys are not a trap”Submitted I'm giving up on HPKP as a story · 127 points
HN discussionTFA's author has also explicitly precluded the "platform-authenticates-you-to-website automatically" workflow, in a separate blog post [0]: > This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism. [0]: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...
Comment linking /xss-is-deadly-for-passkeys-the-hidden-risk-of-attestation-none/?utm_source=scotthelme.co.uk
on “Passkeys are not a trap”Submitted How widely used are security-based HTTP response headers? as a story · 116 points
HN discussion
