Research

Research, teardowns, and arguments.

One surface for the technical work and the writing that connects it: disclosed vulnerability research, technical teardowns, architecture frameworks, and the shorter, more opinionated essays. Where research touches live systems, each page states its disclosure status: who was told, when, and what they said.

Technical TeardownPublished 11 Aug 2026Updated 4 Oct 202615 min read

BotGuard, disassembled — reverse engineering Google’s anti-fraud VM→

A teardown of Google’s BotGuard from public research: the bytecode VM, its anti-debugging and obfuscation layers, and the structural binding gap at the end — a token the server verifies but cannot tie to the machine that made it. Builds on Cypa’s VM analysis and LuanRT’s PO-token research. If you’ve ever wondered what "client-side trust" is really worth, start here.

Reverse EngineeringAnti-Fraud VMBotGuard

Disclosed ResearchPublished 11 Aug 2026Updated 4 Oct 202619 min read

The Achilles' heel of Estonia’s e-state — Smart-ID / eID research→

Protocol-level analysis of the authentication ecosystem that 3.7M+ users in Estonia, Latvia, and Lithuania rely on (SK, October 2025). Covers the threat model, an interactive signing-relay class of attack, the June 2026 Smart-ID+ rollout, and the regulatory picture (eIDAS, PSD2, DORA, NIS2, GDPR). Reported to SK ID Solutions in November 2025; the dated disclosure timeline is on the page. Names the gaps; proposes the fixes.

Smart-IDeIDASCoordinated Disclosure

FrameworkPublished 11 Aug 2026Updated 4 Oct 202624 min read

Zero-Trust Octagon — a framework from first principles→

Most "zero trust" is a vendor checklist. This is the opposite: 8 axioms, a 9-dimension morphological matrix for reasoning about any architecture, and composite breach walkthroughs that show where designs fail. Sources are linked and corrections logged. Written to be argued with.

ArchitectureZero TrustNIST 800-207

AnalysisPublished 8 Sep 2026Updated 4 Oct 202613 min read

The PIN that cannot be delegated — Smart-ID, AI agents, and eIDAS→

Why an AI agent cannot enter your Smart-ID PIN: SK ID Solutions' own terms, the remote-QSCD practice statement, and eIDAS Articles 26 and 32 read side by side. Why the better reading ties sole control to the moment of signing, what can lawfully be delegated instead, and the OAuth-style pattern that works.

Smart-IDeIDASAI Agents

EssayPublished 22 Jun 2026Updated 4 Oct 20268 min read

I used to break authentication. Here’s what that taught me about building it.→

The thesis essay for this site: why understanding offense is a prerequisite for credible defense, worked through one example from the Smart-ID relay research.

EssayPublished 11 Aug 2026Updated 4 Oct 20269 min read

What client-side trust is actually worth→

Using the BotGuard teardown as a case study: the structural reason any defense that runs on a machine you don’t control is negotiable, and what to do about it.

EssayPublished 6 Sep 2026Updated 4 Oct 20265 min read

The fix that doesn’t need SK→

The Achilles' heel report lists five fixes for the Smart-ID signing relay, each needing a regulator, the banks, or a legislature or court to move first. Here’s a sixth, not new but under-used: a check of each session against the account’s device and network history that a bank can run today. Paršovs and LHV got there first, and PSD2 already requires this kind of monitoring. It is strongest against attacker-session vishing and the cross-device relay, and weakest against victim-initiated transfers.

Smart-IDFraud PreventionSession Continuity

EssayPublished 11 Aug 2026Updated 4 Oct 20265 min read

The kratt problem→

On offensive capability as a folkloric kratt — tireless while it has direction, dangerous the moment it doesn’t. A short piece on ethics, idleness, and pointing tools in the right direction.

EssayPublished 11 Aug 2026Updated 4 Oct 20269 min read

Coordinated disclosure in a small country→

What it’s actually like to disclose a flaw in critical digital infrastructure when everyone in the room knows each other — the legal exposure, the incentives, and why owning your own story is the only real protection.

Critical AnalysisPublished 28 Aug 2026Updated 4 Oct 202614 min read

PACT and the software-anchor turn — a critical analysis of Private Access Control Tokens→

PACT, announced in June 2026 by Cloudflare with Firefox, Chrome, Edge, and Shopify, is, as its designers describe it, privacy-preserving rate limiting: Anchors vouch anonymously, Moderators enforce the limit. The ACT/ARC cryptography is sound. Who may act as an Anchor, and how sites judge them, is still undecided, and that decides whether the web gets an open anti-bot layer or another trust oligopoly.

PACTPrivacy PassAnti-Fraud

Reference PaperPublished 26 Aug 2026Updated 4 Oct 202616 min read

The evolution of cyber fraud in Estonia, 2017–2026→

How Estonia’s small language held the fraud industry at arm’s length, and what happened when the barrier fell in late 2024: recruited native speakers, industrialized vishing call centers, courier networks, and AI deepfakes. Police-reported losses rose from about €8 million in 2023 to €29 million in 2025, with €13.2 million more in the first half of 2026, as banks began rolling out Smart-ID+. A reference paper built from PPA and RIA data, SEB’s Baltic victim statistics, and the ERR/Äripäev investigation.

PhishingVishingAI FraudEstonia

Fact CheckPublished 6 Sep 2026Updated 4 Oct 202611 min read

ChatGPT is not a phishing scanner→

A fact check of the advice to paste a suspicious link into ChatGPT. What ChatGPT, Claude, and Gemini actually document about checking links, domain age, and reviews; why TDS and AI-targeted cloaking can serve an assistant's fetch a decoy page; and why VirusTotal and Google's Safe Browsing site-status page are a better first check, though not a final verdict.

PhishingLLMsCloaking

Reference PaperPublished 14 Sep 2026Updated 4 Oct 202613 min read

The Gray Space: Russian-Linked Proxy and Hosting Infrastructure in Estonia→

In September 2026 QualityNetwork OÜ, a named operator of the Fineproxy proxy service, became a RIPE LIR and was allocated former Region40 prefixes. An OSINT reference tracing that network through Qurium’s DDoS reports (Azerbaijan 2018–2019, Rappler 2023), what the record does and does not show about Vault Dweller OÜ’s withdrawn AS203834, and why none of it is proven Russian state activity.

OSINTEstoniaProxy NetworksInfrastructureDDoS

Threat Model AnalysisPublished 22 Sep 2026Updated 4 Oct 202615 min read

How client-side anti-fraud actually works, and what VLM agents change→

Client-side anti-fraud measures the cost of forgery, not humanity. An AI agent that operates a stock browser from the operating system forges nothing inside the browser. What that does to each of the five defensive paradigms, what a small testbed measured, and why the open question is now who controls the root of trust.

Anti-AutomationVLMAttestationThreat Model

Framework AnalysisPublished 22 Sep 2026Updated 4 Oct 202614 min read

The Nine Dimensions of Zero Trust→

The nine-dimension morphological matrix laid out dimension by dimension: nine coupled architectural choices, the canonical values for each, and why most architectures fall into one low-maturity cluster.

Zero TrustArchitectureMorphological MatrixAttestation

Breach TracePublished 22 Sep 2026Updated 4 Oct 20268 min read

The Fortune 500 Illusion of Control→

The largest security budget, the most tooling, the most attestations — and a breach that runs from a stolen session cookie to a full database export in twenty minutes. A step-by-step trace of Archetype B, an analytical composite, not a real incident.

Zero TrustIncident AnalysisContinuous VerificationEnterprise

Breach TracePublished 22 Sep 2026Updated 4 Oct 202611 min read

Move Fast, Fix It In Prod: A Full Breach Trace of the Startup Archetype→

A composite breach trace of the startup archetype: a malicious dependency robs the CI pipeline, passes the only gate, and reaches production with a valid identity. Why the pipeline is the highest-value target in a velocity-optimised architecture, and which fixes a startup will actually keep.

Zero TrustSupply ChainCI/CDKubernetes

Breach TracePublished 22 Sep 2026Updated 4 Oct 202611 min read

SaaS-Glued Lean Defense: The Full Breach Trace for Archetype D→

A small team running on a dozen SaaS products, traced as a composite breach: MFA fatigue, a stolen session the proxy never sees, and what one person can start fixing in an afternoon.

Zero TrustSaaSMFA FatigueIdentity

Framework AnalysisPublished 22 Sep 2026Updated 4 Oct 202610 min read

Identity Is the Root. Proof Is the Gate.→

Every other control in a zero-trust architecture consumes an identity claim it did not produce. This is why the quality of the proof at the gate sets the ceiling, why strong cryptography still fails at the approval layer, and why phishing resistance alone does not close the gap.

Zero TrustAuthenticationIdentityeID

Systems

The research is the findings and the arguments. The systems are what I ship under the threat models they describe — tools, security products, and backend services running in production.

Browse systems →