Tom Kristian Abel · Estonia

I broke authentication for a living. Now I build the kind that doesn’t.

I’m Tom Kristian Abel, a systems architect and security researcher. I reverse engineer how authentication and browser defenses fail, then design the systems that survive what I find.

Read the research View systems

The fault line

Most of my work lives at one fault line: the gap between what a system claims to verify and what it actually verifies.

I’ve spent years on both sides of that gap — first exploiting it, now closing it. These days I research identity protocols (FIDO2 / WebAuthn, eIDAS, Smart-ID), reverse engineer anti-fraud systems at the opcode level, and ship production platforms built secure-by-design. I disclose what I find, in public, and I take responsibility for all of it.

Featured work

Selected research and shipped systems

Teardown · Google’s anti-fraud VM

BotGuard, disassembled

A teardown of Google’s VM-based anti-fraud system from public research — the bytecode VM, the anti-debug mechanisms, and where token binding stops.

Reverse Engineering
Anti-Debug

Read →

Disclosure · SK ID Solutions, RIA

Smart-ID / eID research

Research on the approval layer of Estonia’s national authentication stack, reported to SK ID Solutions first, then escalated to RIA and other regulators.