W. Miller
Writes about security.
11 articles
-
OneTimeSecret vs Privnote vs Password Pusher: Which Should You Use?
Password Pusher for IT teams, OneTimeSecret for simple open-source secrets, Privnote only for throwaway notes: compared on encryption, expiry and revocation.
· Security · 6 min read
-
Is Privnote (privnote.com) Safe and Legit? 2026 Review
Privnote is safe enough for a casual note and not for credentials: documented clone-site phishing, encryption you cannot verify, and no way to revoke a note.
· Security · 8 min read
-
7 Best Privnote Alternatives in 2026 (Free & Self-Hosted)
The best Privnote alternative is LinkPilot for an audit trail, Bitwarden Send if you use Bitwarden, or PrivateBin for verifiable encryption; seven compared.
· Security · 21 min read
-
Why URLs Leak Sensitive Information (and How to Fix It)
Browser history, server logs, CDNs, and Referer headers keep full URLs, even over HTTPS. Where links leak and how to design URLs that are safe to leak.
· Security · 8 min read
-
Secure Link Sharing for Developers
A practical guide for engineering teams — when to use one-time links, how to script them, and how to integrate them into onboarding and CI.
· Security · 8 min read
-
Secret Links vs Password Managers
A password manager stores credentials a team reuses; a one-time secret link hands one credential to one person once. Most teams need both, for different jobs.
· Security · 6 min read
-
Link Scanners and One-Time Secrets
A one-time link that burns on a plain GET dies when Slack or an email gateway previews it. Serve metadata on GET and burn only on an explicit reveal.
· Security · 9 min read
-
How to Share API Keys Securely
Never paste an API key into chat or email. Send a one-time secret link, encrypted in your browser and destroyed after one open, and rotate any key you pasted.
· Security · 8 min read
-
How One-Time Secret Links Work
A one-time secret link reveals its contents once: the browser encrypts it, the server stores only ciphertext, and the first reveal burns the stored copy.
· Security · 8 min read
-
Expiring Links: The Secret Is Destroyed, Not Just Redirected
An expiring secret link destroys the secret at the deadline; a dead shortener link only stops redirecting. How to pick a window, and the edge cases.
· Security · 8 min read
-
Client-Side Encryption for Secret Sharing: What It Protects, What It Doesn't
Client-side encryption protects a stored secret from the operator and a database leak, nothing more: bad JavaScript, extensions and a leaked link defeat it.
· Security · 11 min read