Authentication security researcher. I analyze how authentication systems fail at the client and protocol level, and I build specifications for systems that survive what I find.
Based in Estonia. I write in English and Estonian. Most of my work sits on one fault line: the gap between what a system claims to verify and what it actually verifies.
Findings are published with their disclosure status attached, and the published text is signed, so they can be checked rather than trusted.
- google-botguard-security-research — SoK: Client-Side Anti-Automation Under VLM-Based Attack. A systematization of five paradigms of client-side anti-fraud, from VM attestation to hardware-anchored determinism, with a cost model for VLM-based operator synthesis attacks. Companion opcode-level teardown of Google's BotGuard VM at tomabel.ee/disclosures/botguard-disassembled.
- smart-id-security-research — Independent protocol-level research on Smart-ID and cross-device eID flows: why MITM and endpoint replacement fail by design, how the approval layer fails instead, and what cryptographic origin binding and a FIDO2 migration path would change. Disclosed to the vendor before publication.
- zero-trust-octagon — Zero-trust architecture from first principles: eight irreducible axioms, a nine-dimension morphological matrix, four archetypal breach analyses, and 24-month implementation roadmaps.
- fingerprintproxy — A standalone TLS fingerprinting forward proxy in Go. Applies real browser TLS fingerprints (JA3/JA4, 72 profiles) to outbound requests so you can test what your anti-bot layer actually sees.
- ee-eudiw — Estonian EUDI Wallet: an independent technical specification with a zero-knowledge proof-of-age profile, plus a working ZK age-proof demo over ISO 18013-5 mdoc. Currently private while the demo is finished; public soon.
- ZK age-proof demo over ISO 18013-5 mdoc for the Estonian EUDI Wallet
- Server-side companion analysis to the BotGuard SoK
- Smart-ID protocol analysis and coordinated disclosure
- 🌐 tomabel.ee — research, disclosures, and essays
- 🏢 proksiabel.ee — ProksiAbel OÜ
- 📄 ORCID 0009-0009-9881-1293
- 🔑 PGP
I was previously active as M41KL-N41TT (archived). That account holds earlier work from a different period of my life. My current research and published work lives here.