Royce Williams

https://infosec.exchange/@tychotithonus

Just doing my undue diligence.

ISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.

Day job: Enterprise Security Architect for an Alaskan ISP.

Obsessed with security keys:
techsolvency.com/mfa/security-keys

My 2017 #BSidesLV talk "Password Cracking 201: Beyond the Basics":
youtube.com/watch?v=-uiMQGICeQY&t=20260s

Followed you out of the blue = stole you from someone I respect.

Blocked inadvertently? Ask!

Am I following a dirtbag? Tell me!

Suggestions welcome!

Photo: White 50-ish man w/big forehead, short beard, & glasses, grinning by a display of Alaskan license plates.

Boosts not about security ... usually are.

Banner: 5 rows of security keys in a wall case.

#NonAIContent

#hashcat #Alaska #YubiKeys #LicensePlates

P.S. I hate advance-fee scammers w/heat of 400B suns

❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!

Stuff: https://www.techsolvency.com/roycewilliams/mastodon
Keybase: https://keybase.io/royce
GitHub: https://github.com/roycewilliams
LinkedIn: https://www.linkedin.com/in/roycewilliams
Gravatar: https://gravatar.com/tychotithonus
Not "dehashed"!: https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/

Public Key

npub1d9j86kugzarj4skw6juglk2de6mful9svqu8yac6vum5wz5xtcwsyv7m3z

NIP-05 Address

tychotithonus_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsxjeratwypw3e2ct8dfwy0m9xuad570jcxqwrjwudxwd68p2r9u8gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnts209np

Publishing to

relay.momostr.pink

Author Public Key

npub1d9j86kugzarj4skw6juglk2de6mful9svqu8yac6vum5wz5xtcwsyv7m3z

Show more details

Published at

2026-04-16T15:19:22Z

Kind type

0 Metadata

Event JSON

{ "id": "80ee1d02412eb6ec0b708de9f32b0045768a69d4e4b9e4804d4fc011dfe41d96", "pubkey": "69647d5b8817472ac2ced4b88fd94dceb69e7cb0603872771a6737470a865e1d", "created_at": 1776352762, "kind": 0, "tags": [ [ "t", "alaska" ], [ "t", "hashcat" ], [ "t", "bsideslv" ], [ "t", "yubikeys" ], [ "t", "licenseplates" ], [ "t", "nonaicontent" ], [ "proxy", "https://infosec.exchange/users/tychotithonus", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/tychotithonus", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Royce Williams\",\"about\":\"Just doing my undue diligence.\\n\\nISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.\\n\\nDay job: Enterprise Security Architect for an Alaskan ISP.\\n\\nObsessed with security keys:\\ntechsolvency.com/mfa/security-keys\\n\\nMy 2017 #BSidesLV talk \\\"Password Cracking 201: Beyond the Basics\\\":\\nyoutube.com/watch?v=-uiMQGICeQY\u0026t=20260s\\n\\nFollowed you out of the blue = stole you from someone I respect.\\n\\nBlocked inadvertently? Ask!\\n\\nAm I following a dirtbag? Tell me!\\n\\nSuggestions welcome!\\n\\nPhoto: White 50-ish man w/big forehead, short beard, \u0026 glasses, grinning by a display of Alaskan license plates.\\n\\nBoosts not about security ... usually are.\\n\\nBanner: 5 rows of security keys in a wall case.\\n\\n#NonAIContent\\n\\n#hashcat #Alaska #YubiKeys #LicensePlates\\n\\nP.S. I hate advance-fee scammers w/heat of 400B suns\\n\\n❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!\\n\\nStuff: https://www.techsolvency.com/roycewilliams/mastodon\\nKeybase: https://keybase.io/royce\\nGitHub: https://github.com/roycewilliams\\nLinkedIn: https://www.linkedin.com/in/roycewilliams\\nGravatar: https://gravatar.com/tychotithonus\\nNot \\\"dehashed\\\"!: https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/\\n\",\"website\":\"https://infosec.exchange/@tychotithonus\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/108/195/621/247/550/549/original/d96204cc09c9dbfe.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/108/195/621/247/550/549/original/a838db735a039849.jpg\",\"nip05\":\"tychotithonus_at_infosec.exchange@momostr.pink\"}", "sig": "cd250df307b5baf7efb8c50579af77596b1fe4112f9e717c3c0cbaed7582ed0db8c601ab56a64a135e8bfb60e58552e2bae750ec95d879ae77ad3feec06d282b" }

Last Notes

2026-04-17 14:54:02 UTC

- reply

https://www.
ietf.org/archive/id/draft-meow
-mrrp-00.html

2025-08-18 14:56:34 UTC

These can both be true: <li><p>Passkey deployment has been fraught with UX challenges, failures to advise users about threat model trade-offs, and vendor lock-in concerns </p></li><li><p>The ecosystem couldn't go much longer without the benefits of passkeys (reducing password reuse risk, mitigating infostealer harm, and deploying FIDO2 phishing resistance at scale)</p></li>
#Passkeys

2025-08-17 15:39:19 UTC

So ... is the new Sandia time-independent MFA thing:
https://www.sandia.gov/labnews/2025/07/24/two-factor-authentication-just-got-easier/
... just ... renegotiating a new per-client code every time there's a new connection?
Like ... how garage door openers have worked ... since the mid-90s?

2025-05-08 12:47:15 UTC

Really hoping that the title - of the W3C's position paper - "Third-Party Cookies Must Be Removed":
https://w3c.social/@w3c/114432468864338537
... is a deliberate echo of "Carthage must be destroyed":
https://en.wikipedia.org/wiki/Carthago_delenda_est

2024-10-09 22:43:39 UTC

- reply

"So confident in my password generation that I'm willing to post my password hash" is a legit flex. 😁

2024-10-09 22:26:42 UTC

At least Internet Archive was using bcrypt!
Any word on what work factor?

2024-09-03 18:24:37 UTC

- reply

Indeed - ensuring prompt revocation workflow for security keys has always been best practice. Also, according to the Ars Technica article, the bar is higher:
"The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low."
So it's not like "proxmark reader in a backpack, dude having a smoke outside the data center" level of cloning. :D

2024-06-11 22:31:16 UTC

- reply

And the original authors of login.defs, PAM, etc did sooo much damage by choosing to name many of the earlier hash selections using their primitives. 😢

2024-05-14 01:08:54 UTC

So [@solardiz](https://bird.makeup/users/solardiz ) presented a talk on "Password cracking: past, present, future" at OffensiveCon last week. Definitely worth a read - bringing his usual disciplined thinking to a topic he knows very well.
He includes both historical and taxonomical perspectives, both of which I appreciate. Apparently, one of the first password-cracking contests was in 1982? (This was a password *cracker* contest - seeking the best *cracking software*!)
https://www.openwall.com/presentations/OffensiveCon2024-Password-Cracking/
[Will update post if video of the talk itself appears.]
#passwords #hashing
#PasswordCracking