Multi-factor authentication was sold as the cure for phishing, and for a while it was. Then real-time proxy phishing, push-bombing, and SIM swaps caught up. The 2022 breaches at Twilio and Uber — and the Cloudflare attack that failed — were the field test. A threat-model walk through why only origin-bound MFA survives, and how to deploy it.
Zero-Trust
-
Phishing-Resistant MFA: Why Everything Short of FIDO2 Is Living on Borrowed Time -
Tailscale Funnel vs Cloudflare Tunnels: Two Ways to Expose a Service Through NAT Both Tailscale Funnel and Cloudflare Tunnels solve the same problem — getting public traffic to a service behind NAT without forwarding a port — but they make opposite architectural bets. A deep dive on the data planes, who terminates your TLS, the identity models, the real limits, and which one to actually reach for.
-
Cloudflare Tunnels for Secure Homelab Exposure How Cloudflare Tunnels work, setting up cloudflared for zero-port-forward homelab access, Cloudflare Access for authentication, configuration via YAML and the dashboard, and an honest look at the privacy tradeoffs and free tier limits.
-
Tailscale: The WireGuard Mesh VPN That Actually Works Everywhere A deep technical guide to Tailscale: how the mesh VPN works under the hood, complete setup for every platform, subnet routing and exit nodes for homelab access, ACL policy files, MagicDNS, Tailscale Funnel and Serve, self-hosting the control plane with Headscale, and an honest comparison with WireGuard, ZeroTier, and Netbird.
-
Teleport: Zero-Trust Access for Infrastructure Replace SSH keys, VPN, and static database credentials with Teleport's certificate-based access plane — covering servers, Kubernetes, databases, web apps, CI/CD bots, and audit logs.
-
mTLS Everything: Certificate-Based Service Identity with SPIFFE, SPIRE, and Envoy A comprehensive guide to mutual TLS—covering certificate-based service identity, SPIFFE/SPIRE workload attestation, mTLS with Envoy sidecars, Istio's control plane, and building a zero-trust service mesh from the ground up.
-
Zero Trust Architecture in Practice: Beyond the Buzzword A practical guide to implementing Zero Trust Architecture: moving beyond VPNs with identity-aware proxies, mTLS between services, and real-world patterns using Tailscale and Cloudflare Access.
-
Zero Trust Networking: Principles and Practical Tools A comprehensive guide to Zero Trust networking — the philosophy, core principles, and practical implementation using Tailscale and Cloudflare Access, including ACL configs, tunnel setup, and a homelab architecture that replaces legacy VPNs.