https://rivik.dev/categories/security/Recent content in Security on Ilya Rusalowski HubHugoen-usSat, 06 Jun 2026 00:00:00 +0000https://rivik.dev/ykvault-stop-storing-api-tokens-as-plaintext/Sat, 06 Jun 2026 00:00:00 +0000https://rivik.dev/ykvault-stop-storing-api-tokens-as-plaintext/Are you still keeping API tokens in ~/.secrets? Any app you install can read them. ykvault encrypts every secret with a YubiKey challenge-response key — each get/set requires a physical touch, and the encrypted files are useless without your key.https://rivik.dev/hardware-backed-ssh-keys-end-to-end-yubikey-piv-software-alternatives-and-where-ssh-cas-fit-in/Sat, 09 May 2026 00:00:00 +0000https://rivik.dev/hardware-backed-ssh-keys-end-to-end-yubikey-piv-software-alternatives-and-where-ssh-cas-fit-in/A working guide to using a YubiKey for SSH on a real Linux fleet — the four knobs (resident, touch, PIN, agent), a four-mode policy for root and Ansible, software-only alternatives, and where SSH CAs fit in.https://rivik.dev/180-breaches-a-second/Fri, 03 Apr 2026 00:00:00 +0000https://rivik.dev/180-breaches-a-second/180 accounts are breached every second — and most of it comes down to reused passwords and missing MFA. A look at the software quality collapse behind the headlines, and why the fix is the same infrastructure-level move HTTPS once made: passkeys, on-device DLP, and capability-scoped AI agents.https://rivik.dev/when-tls-1.3-silently-dies-inside-your-android-proxy/Fri, 20 Mar 2026 00:00:00 +0000https://rivik.dev/when-tls-1.3-silently-dies-inside-your-android-proxy/A post-mortem of intermittent HTTPS failures across a mobile proxy fleet: TLS 1.3 handshakes silently dying on memory-starved Android devices — large multi-packet handshake messages, inflated by post-quantum key shares, stressing proxy buffers under memory pressure.