Security Toys — small pages that break a misconception

Each one is a single self-contained page built to kill one specific wrong idea that slides reliably fail to kill. No install, no account, no network. Save the page and it still works. Part of the Assume-Breach series.

Crack Time

Kills: “complexity is what matters”. Time-to-crack is length × algorithm × work factor — and two of those three are the site’s decision, not yours.

Ready

Defence in Depth

Kills: “we bought a firewall, we’re fine”. Layer the controls, misalign the holes, and buy the longest attack path your budget allows.

Ready

Detection Dial

Kills: base-rate neglect. One threshold, 10,000 events, 3 real intrusions — and no setting that gives you both a clean queue and full coverage.

Ready

Rule Order

Kills: “a ruleset is a set”. It’s a sequence, first match wins, and a leftover catch-all can silence every rule beneath it.

Ready

Query Builder

Kills: injection as magic incantation. Watch the SQL assemble as you type, then flip one toggle and watch the same input go inert.

Ready

EXIF Drop

Kills: “a photo is a picture”. Camera, timestamp, serial number, and the coordinates of wherever you were standing. Entirely in your browser.

Ready

The Cipher Bureau

Kills: “hashing is encryption”. Six live exhibits from Caesar’s wheel to real AES-GCM — and a one-way fingerprint that no key will ever reverse.

Ready

House rules