What I do
Three kinds of work, one discipline: assume the attacker, design for the defender.
Selected courses
Practical security, taught the way it is practiced.
Mobile Device Security
iOS & Android security models, app security, secure comms, hardware roots of trust, RE, forensics.
WorkshopiOS Camera Internals & Anti-Spoofing
AVFoundation capture stack, Frida instrumentation, spoofing demos and countermeasures.
MasterclassModern Auth Deep Dive
OAuth 2.0, OpenID Connect, WebAuthn and HTTP Basic with secure defaults and animated flows.
WorkshopmacOS Desktop Application Security
Codesigning, sandbox, TCC, Hardened Runtime, memory and screen access, secrets.
MasterclassKYC โ Privacy-Preserving Tokens
User-centric identity: selective disclosure, unlinkable tokens, revocation and recovery.
WorkshopWeb App Reverse Engineering
Read minified bundles, instrument runtime, reproduce requests in a lab, harden the app.
Writing
Notes on identity verification and the ways it fails.
eKYC Pitfalls
Over-collection, PII honeypots, weak liveness, ignored device security, and a safer baseline.
Blog PostIdentity Theft: How Attackers Exploit Weak Identity Systems
Attack vectors, most-targeted profiles, and what users can do when platforms fail them.
Blog PostWhen Insiders Exploit Weak eKYC
A timeline of how former banking employees weaponized flawed verification flows.
About
Full portfolioContact
Questions, a project, or a workshop for your team? Write a few lines.