I build web applications and I'm into web application security. I like to speak about secure development. My mission is to teach web developers how to build secure and fast web applications and why. (more about me, contact)

My trainings

And this is what they say about them: Originally, I've arranged Michal's training primarily for my colleagues because "of course I already know these things"... Michal has changed my mind in the first hour of the first day and continued to do so for the whole two days. Thanks to this training I finally understood some of the attack/defense concepts in full depth, and especially in the right context. — Jan Pospíšil, Senior PHP developer, Czech Radio

Public trainings

Come to my public trainings, everybody's welcome:

Trainings in Prague are held regularly in the middle of March, June, September, and December, in other cities irregularly.

In-house trainings

Any public training can also be turned into an in-house training. As an extra, I offer these in-house-only courses:

Looking for Introduction to PHP, Classes and objects in PHP? I've handed them over to Martin Hujer. I've discontinued Web application performance, Martin Michálek runs a similar training.

My articles

I don't use any VPN for security or anonymity
October 23, 2019

NordVPN, a VPN service provider, got hacked some time in 2018. In their official response, they say that only one server was affected due to an insecure remote management system left on the machine by the datacenter provider. Private keys got leaked (bad), some other VPN providers were also breached (bad) but that's not what I want to write about (good) because there are better places to read about it.

(read more…)

Top 10 coffee brands according to Have I Been Pwned

Top 10 coffee brands based on how much their names are used as passwords. Look, not every password research has to be meaningful.

(read more…)

Android-based 2FA security key
April 11, 2019

Yesterday, Google announced yet another Security Key to be used for two-factor authentication (2FA, sometimes 2-step verification, 2SV) for Google's services. This one is built directly into Android 7+ so you may already have it in your pocket. It uses Bluetooth (but pairing isn't required) and currently works only in Chrome and Chromium-based browsers – Google says it's a beta version. And that's basically all we know about it. I use 2FA where possible, I recommend using it whenever possible so I just had to try it.

(read more…)

All articles

My talks

Favorites

Upcoming talks

…at your event or conference, let me know!

Talks

Vyhledávejte na netu jako MacGyver
November 13, 2019, Vítejte v nebezpečném světě, Comimpex (60 minutes)

Minority Reports
November 3, 2019, OpenAlt (45 minutes)

Vyhledávejte na netu jako MacGyver
November 2, 2019, OpenAlt (45 minutes)

Zámečky nikoho nezajímaj'
November 2, 2019, OpenAlt (45 minutes)

Defense in Depth
October 24, 2019, Bezpečnost při vývoji software, Diskuze u Mastera (30 minutes)

All talks

Me answering questions

Engage in Continual Learning to Advance your IT Career
May 3, 2019, IT Career Energizer

Michal Špaček z Report URI o smyslu práce, potenciálu i prokrastinaci
January 15, 2019, StartupJobs

Blokování webů a stránek
June 4, 2016, Český rozhlas Online Plus

Na 11. srazu Na volné noze
June 4, 2016, 11. sraz Na volné noze

Webový vývojář musí mít hackerské myšlení
May 30, 2016, Kyberbezpečnost.cz

All interviews