Library

Six series, 27 chapters. Start with the fundamentals or jump to the topic you're on call for.

6 series

What a one-time password actually guarantees, how a code travels from your server to a handset, and how to read the signals carriers send back.

The screen where most OTP flows lose users. Input design, autofill, clipboard hints and error copy that helps people without helping attackers.

Delivery reports and verification events arrive as webhooks. Learn to sign, verify, reject replays and rotate secrets without downtime.

SMS pumping, brute force and enumeration. Attempt counters, cooldowns, progressive delays and the monitoring that tells you when they fail.

No single channel is always up. Combine SMS, chat apps and voice into an ordered, observable fallback strategy.

When the attacker controls the phone number itself. SIM-swap mechanics, risk signals, step-up ceremonies and learning from incidents.