How to Protect APIs From Unwanted Automation
An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.
Fingerprints Are Evidence, Not Identity
Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.
Account Security Without Tracking People
Safer logins do not require treating people as products. Account defence should use minimised, purpose-bound risk signals and proportionate decisions.
The Invisibility Cloak
Learn how attackers combine residential proxies and anti-detect browsers to evade detection and how modern security tools can fight back.
How MTU Fingerprinting Identifies VPNs and Mobile Users
Infer an apparent path MTU from TCP handshake data, compare it with common tunnel overheads and use it as one bounded network-path signal.
Anti-Detect Browsers
Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.
Google Chrome's "IP Protection" vs Apple Private Relay
An exploration of Google Chrome's new "IP Protection" feature and a comparison with Apple's iCloud Private Relay.
JA4 and JA4+ Network Fingerprinting
How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.
Google Chrome's "IP Protection" and Online Privacy
An exploration of Google Chrome's new "IP Protection" feature, its promise of enhanced privacy.
Chrome's TLS Extension Randomisation Experiment
Does TLS extension randomisation assist in hiding Chrome?
TLS Fingerprinting
What is fingerprinting, and in particular TLS fingerprinting?