February 24-26, 2027
Montreal, Canada
The Request Was Signed. Why Was It Still Unsafe?
In our wallet, third-party services received digitally signed requests, so it was easy to assume that a valid signature meant the request was safe. It wasn’t. A signed request could still be replayed, retried after a timeout, arrive with clock skew, or leave important fields outside the signature. This talk looks at those failure cases and the practical use of nonces, idempotency, key rotation, and replay protection to handle them safely.
Hanieh Ershadbakhsh
Global relay
Hanieh Ershadbakhsh is a Vancouver-based Java developer who enjoys solving the hard problems behind financial systems—concurrency, messaging, failures, and reliability at scale. She has 7+ years of experience building payment and distributed systems processing millions of transactions. Hanieh has also taught Java as a Bootcamp Instructor and presented technical topics in academic and professional settings, including her research on risks in mobile payment applications.
