Michal Špaček

I build web applications and I'm into web application security. I like to speak about secure development. My mission is to teach web developers how to build secure and fast web applications and why. (more about me, contact)

My trainings

And this is what they say about them: Originally, I've arranged Michal's training primarily for my colleagues because "of course I already know these things"... Michal has changed my mind in the first hour of the first day and continued to do so for the whole two days. Thanks to this training I finally understood some of the attack/defense concepts in full depth, and especially in the right context. — Jan Pospíšil, Senior PHP developer, Czech Radio

Public trainings

Come to my public trainings, everybody's welcome:

PHP application security December 2019 Praha2 days
HTTPS for developers and admins December 2019 Praha

Trainings in Prague are held regularly in the middle of March, June, September, and December, in other cities irregularly.

In-house trainings

Any public training can also be turned into an in-house training. As an extra, I offer these in-house-only courses:

Security for users

Looking for Introduction to PHP, Classes and objects in PHP? I've handed them over to Martin Hujer. I've discontinued Web application performance, Martin Michálek runs a similar training.

My articles

Top 10 coffee brands according to Have I Been Pwned

May 8, 2019

Have I Been Pwned, passwords, coffee, silly research

Top 10 coffee brands based on how much their names are used as passwords. Look, not every password research has to be meaningful.

(read more…)

Android-based 2FA security key

April 11, 2019

Google, Android, 2FA, password manager

Yesterday, Google announced yet another Security Key to be used for two-factor authentication (2FA, sometimes 2-step verification, 2SV) for Google's services. This one is built directly into Android 7+ so you may already have it in your pocket. It uses Bluetooth (but pairing isn't required) and currently works only in Chrome and Chromium-based browsers – Google says it's a beta version. And that's basically all we know about it. I use 2FA where possible, I recommend using it whenever possible so I just had to try it.

January 23, 2019

passwords, cracking, hash, data leak

Yesterday I checked Czech websites in “Collection #1” and others (like “Collection #2” to “Collection #5”, “BigDB”), today I've checked Slovak sites. We're neighboring countries and historically have a lot in common, many Czech users have accounts on Slovak sites as well, so it seemed like a good idea.

(read more…)

All articles

My talks

Favorites

HTTP hlavičky, Subresource Integrity a spol. chrání vaše návštěvníky před bezpečnostními chybami
XSS PHP CSP ETC OMG WTF BBQ, o Cross-Site Scriptingu a Content Security Policy
Hlava není na hesla, použijte na ně raději password manager
HTTPS, co, proč, jak, zač, nač, kdy, kde, s kým a proti komu
Webová bezpečnost, popis několika základních útoků i méně známých triků
Jak jsme zlepšili zabezpečení Slevomatu a jak byste měli udělat to samé
Zahashovat heslo, uložit, …, profit!, o správném hashování hesel