David Adrian
@dadrian.io
Used to do TLS, still kind of do TLS. PM at Chrome Security. Founded Censys. @scwpod.bsky.social
Are you coming to Vegas for BlackHat and DEF CON? Come to our happy hour! securitycryptographywhatever.com/events/black...
SCWPodCon BlackHat 2026
"Security Cryptography Whatever" is hosting a party during BlackHat USA 2026, once again brought to you by Teleport!
securitycryptographywhatever.com
securitycryptographywhatever.com/2026/03/25/a... is very very good. If you read my vulnerabilities post, this podcast episode is much more worth listening to.
AI Finds Vulns You Can’t With Nicholas Carlini
Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It’s all very high-brow ...
securitycryptographywhatever.com
New episode! We talk to @lcamtuf.coredump.cx about the vulnpocalypse. www.youtube.com/watch?v=uI9C...
Facing the Vulnpocalypse with lcamtuf
YouTube video by Security Cryptography Whatever
youtube.com
I poked around with @exe.dev some, and wrote up how I think their Github integration works, because it's pretty cool. dadrian.io/blog/posts/e...
Proxies all the way down.
A couple of days ago, exe.dev raised a lot of money1. I decided to poke around with it a little, and signed up. Their trial is 7 days long, so despite having no actual plans, I just started doing stuf...
dadrian.io
NEW EPISODE! The gang learns a bitter lesson about AI and bug finding! Returning champion Nicholas Carlini is back to talk about Claude for vulnerability research. securitycryptographywhatever.com/2026/03/25/a... www.youtube.com/watch?v=_IDb...
AI Finds Vulns You Can't With Nicholas Carlini
YouTube video by Security Cryptography Whatever
youtube.com
new Joy of Cryptography just dropped (feat. Post-Quantum Crypto)
Extremely psyched about two upcoming SCW guests, one of them this week. We've got very crunch vulnerability research and cryptography stuff coming.
new Merkle Tree Cert only Chrome Quantum Root Store: security.googleblog.com/2026/02/cult...
Cultivating a robust and efficient quantum-safe HTTPS
Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against ...
security.googleblog.com
None of you are giving me enough credit for not participating on the TLS working group mailing list. You're welcome. Everything I don't do, I don't do it for you.
NEW EPISODE! The maintainers of py/cryptography declared that after many years of trying to make it work, they would be moving away from OpenSSL when supporting new functionality and exploring adding other backends: securitycryptographywhatever.com/2026/02/01/p... www.youtube.com/watch?v=dEKB...
Python Cryptography Breaks Up with OpenSSL with Paul Kehrer and Alex Gaynor
YouTube video by Security Cryptography Whatever
youtube.com
I cannot get over how impressive it is what Curt Cignetti accomplished at Indiana
Indiana shall light this holy ring, release its cleansing flame, and burn a path into the divine beyond!
David Adrian@dadrian.io · 7mo agorepent! for the day of sixteen windiana shall be upon us!
This is what zero-trust looks like at the infrastructure layer. Identity and encryption match the lifetime of the thing being secured. If your certificate strategy still assumes stable names and year-long validity, it is already behind reality. letsencrypt.org/2026/01/15/6...
6-day and IP Address Certificates are Generally Available
Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscr...
letsencrypt.org
Final SCW of 2025! We had Matt Bernhard on to talk about cryptographic voting systems, in the wake of the IACR election. (Everybody I voted for in the new election won! Woo!)
Security Cryptography Whatever @scwpod.bsky.social · 7mo agoNEW EPISODE! The IACR lost the keys to decrypt their encrypted election results. We welcome Matt Bernhard who works on secure voting systems to explain which Helios bits are homomorphically additive or not and more: securitycryptographywhatever.com/2025/12/30/i... www.youtube.com/watch?v=euw_...
What a fantastic present to end the year! (swear I woke up like this) @mbernhard.com @durumcrustulum.com @sockpuppet.org @dadrian.io @scwpod.bsky.social
This Bernstein crap drives me up the wall because IT MAKES NO SENSE. Why would the NSA be picking weak crypto to protect US NatSec?! They have mathematicians and clusters in China, too! Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM.
Wonderful news! The kind of thing a lot of software folks across the world have been working to make possible. So stoked the Chrome folks are pushing us forward
David Adrian@dadrian.io · 9mo agoOne year from now, Chrome will enable "Always Use Secure Connections" and warn users before plaintext HTTP by default.
It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption! security.googleblog.com/2025/10/http...
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
security.googleblog.com
One year from now, Chrome will enable "Always Use Secure Connections" and warn users before plaintext HTTP by default.
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...
security.googleblog.com
