Scott Helme

https://infosec.exchange/@ScottHelme

Hacker, researcher, builder of things. Founded
securityheaders.com and report-uri.com, Pluralsight author, BBC hacker in residence, award winning entrepreneur. Likes cars.

Public Key

npub1xqlu80ajfs5qapw8dj8sfatczmdzeu2rkj8seeyzqjxx54zn9y3sqjayrn

NIP-05 Address

scotthelme_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsrq07rh7eyc2qwshrkercy74updk3v79pmfrcvujpqfrr223fjjgcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds7hhcs0

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xqlu80ajfs5qapw8dj8sfatczmdzeu2rkj8seeyzqjxx54zn9y3sqjayrn

Show more details

Last Notes

2026-10-21 17:13:55 UTC

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----
😬
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/480/019/317/538/176/original/1922088fd5a3088e.png

2026-10-14 09:25:23 UTC

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.
The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.
I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.
https://scotthelme.co.uk/passkeys-are-not-a-trap/

2026-09-07 09:20:45 UTC

They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers.
Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too.
I verified how the Manchester Airports Group breach happened:
https://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/