About this site

I write about security for the person on the other side of the login screen.

Who I am

My name is Wenyuan LYU. I am an IT student at Curtin University in Perth, Western Australia, and I am working towards a career in cybersecurity. My background is technical, but the question that keeps me interested is not really a technical one: why is it that the advice given to ordinary users so rarely matches the situation those users are actually in?

I have watched people follow every rule they were given — strong password, antivirus, don't click the link — and still end up compromised, because the rule did not describe what they were looking at. I have also watched people with no security training make good decisions quickly, because someone had once explained the reason behind the rule rather than the rule itself. This site is my attempt to be that explanation.

What this site is for

Every note here follows the same discipline. Take one concrete decision that a non-specialist is asked to make. State what the decision actually is. Show the evidence or the mechanism. Then say what I would do, and why. No fear, no vendor pitch, no "stay safe online".

The three subjects I come back to are:

• Account hygieneThe small number of decisions — multi-factor authentication, unique credentials, recovery paths — that determine whether a breach ends with a password reset or a lost identity.
• Phishing and interface trustWhy "don't click the link" is a rule that fails, and what interface design has to do with it.
• Digital footprintWhat is actually collected when you publish something, and who aggregates it — including the parts you never consciously published.

Why this theme

Security is one of the few areas where the gap between expert practice and public understanding has direct, measurable cost. I want to work in that gap: not only building defences, but making the reasoning behind them legible to the people who have to live with them. A security control that users cannot understand is a control that will be worked around, and the workaround is where the breach happens.

Choosing a public theme rather than a personal one also forces a discipline on the writing. A note about "what I did last week" can be vague. A note about "what you should do about MFA, and here is why" cannot — it has to be right, and it has to be checkable.

How this site is made

This site is a static site: hand-written HTML and CSS, no content management system, no tracking scripts, no third-party analytics, no advertising. There are no cookies set by this site and no fonts loaded from external servers. Every diagram and graphic is drawn by me in CSS or inline SVG rather than sourced from elsewhere, which avoids the licensing problem of reusing other people's images on a public site.

The trade-off is deliberate. Static pages are the least capable form of site, and that is the point: the surface area for something to go wrong — an outdated plugin, a compromised third-party script — is close to zero. It also means the site can be read by anything, including a screen reader or a text browser, and it will still work in five years.

The whole site is public, including its history: the source is at github.com/wlyu-333/wlyu-333.github.io. Every edit I make to it is timestamped and visible, which is a fair demonstration of what an internet footprint actually is — and of why it is worth deciding in advance what you are willing to have on the record.

What I'm working towards

I am completing my IT degree at Curtin and building the practical side of security work alongside it: networking fundamentals, operating system hardening, and the policy side that decides which controls actually get implemented. The notes here are part of that practice — writing an explanation that someone else can follow is the cheapest test of whether I understand the thing myself.

Elsewhere

The same interests, worked out in public. Each profile links back to this site.