u/sassjiTrusted Contributorin r/netsec • Recommends
BlackHat USA 2011: SSL And The Future Of Authenticity
0:00 / 0:00
#ssl#moxiemarlinspike#certificateauthorities
BlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
73K subscribers • 19 videos on Hallway
- Recommended by 10 people: 9 on Hacker News and 1 in engineering communities.
- A classic. People kept recommending it from 2011 to 2016.
- Presented by Moxie Marlinspike, security researcher
- An opinion. It argues one side of a question engineers disagree on.
Intermediate. Assumes working knowledge.
94K views15 years ago10 recommendations
SecurityDistributed systemsCryptographyWeb and application securityNetworking and protocols
Moxie Marlinspike examines the structural weaknesses of the SSL certificate authority system and proposes Convergence, a decentralized notary alternative.
Speaker: MOXIE MARLINSPIKE In the early 90's, at the dawn of the World Wide Web, some engineers at Netscape developed a protocol for making secure HTTP requests, and what they came up with was called SSL. Given the relatively scarce body of knowledge concerning secure protocols at the time, as well the intense pressure that everyone at Netscape was working under, their efforts can only be seen as incredibly heroic. But while it's amazing that SSL has endured for as long as it has, some parts of it -- particularly those concerning Certificate Authorities -- have always caused some friction, and have more recently started to cause real problems. This talk will provide an in-depth examination of the current problems with authenticity in SSL, discuss some of the recent high-profile SSL infrastructure attacks in detail, and cover some potential strategies for the future. It will conclude with a software release that aims to definitively fix the disintegrating trust relationships at the core of this fundamental protocol. For more information or download the video visit: bit.ly/BlackHat_USA_2011_informationWhy it's here
10 people recommend this, 1 disputes itWhat people say. Highly recommended as a classic and eye-opening talk on the fundamental flaws of the certificate authority system and trust agility.
jtdowneyon Hacker News • Recommends
On “Convergence, distributed, secure strategy replacing certificate authorities”
Moxie Marlinspike is the creator of Convergence. I highly recommend watching his Blackhat 2011 talk ( link to this video ) covering authenticity on the web and Convergence.
JonnieCacheon Hacker News • Recommends
On “US judge orders hundreds of sites "de-indexed" from Google, Facebook”
Yeah, I edited my list to include a CA-free encrypted replacement for TCP, just before I saw your comment. To all the super-geniuses reading this: burn your socialmobilelocal startup to the ground tomorrow and do this instead. Start by watching this Blackhat talk I linked elsewhere in the thread, the guy has the right kind of ideas: link to this video
4adon Hacker News • Recommends
On “Setting out plans to monitor all Internet use in the UK”
Businesses (and governments) can legitimately buy root keys that allow MITMing any SSL connection or they could just be a CA themselves (any CA can MITM the whole internet). Here's the best talk I know of this subject: BlackHat USA 2011: SSL And The Future Of Authenticity: link to this video
rakooon Hacker News • Recommends
On “Moving forward on improving HTTP's security”
…e pinning, aka storing _really_ trusted authorities (ie verified by hand) on your computer. Guess what ? Moxie's next project is just that [0 (For anyone curious, I highly recommend Moxie's talk 1 about Convergence, it does a great job at explaining what's the problem, what's Convergence and how it can solve at least part of it) 0 link 1 link to this video…
jvc26on Hacker News • Recommends
On “Diginotar and Comodo hacker the same guy and claims to have owned 4 other CAs”
link to this video The original Comodo attack was discussed by Moxie Marlinspike at Blackhat USA 2011 - quite an interesting discussion on the issue.
aleccoon Hacker News • Recommends
On “The Sovereign Keys Project”
How does this solution deal with the "Citibank problem"? (a website with a huge number of SSL keys from multiple certificate authorities) A great talk from last DefCon link to this video
jcaseon Hacker News • Recommends
On “Enhancing digital certificate security (Fake *.Google.com cert issued)”
…first step in deploying DNSSEC is to create an account with GoDaddy?"2 The 2011 BlackHat video3 and blog post2 by Moxie Marlinspike are great sources of information. IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains. 1 link 2 link 3 link to this video…
glass-on Hacker News • Recommends
On “Sustaining Digital Certificate Security”
Convergence was the perfect replacement, but it never gained any traction. Moxie's talk at BlackHat0 introducing it is a good watch for those unfamiliar with the idea, and if you want to be wistfully frustrated at what could have been. 0 link to this video
Stromon Hacker News • Recommends
On “StartSSL domain validation vulnerability”
You would soon be left without any CAs. 1 People are pretty stupid when it comes to security, and this includes people working for CAs. There have been cases where the CA private key is publicly accessible to the internet without any password. 2 -- 1 Yes, plenty of smart people have been advocating moving away from the current CA system. It's fundamentally broken. 2 A great talk by moxie, filled with horror examples of CAs. The private key example is at 19:20. link to this video
DonHopkinson Hacker News • Disputes
On “Gnu Privacy Guard relies on one underfunded person (2015)”
Wow, I missed that story the first time around. Just catching up on the details. That Comodo CEO Melih Abdulhayoğlu is such a dishonest, incompetent buffoon! I had no idea how terrible a company Comodo is, but now I do thanks to the CEO's own words and actions. link to this video
derridaon Hacker News • Mentions
On “Iran forged the wrong SSL certificate”
It is indeed based on Perspectives. But the implementation provided with Perspectives does not have privacy. If you contact a notary with Perspectives then that notary has your browsing history. See 36:50 on link to this video
moxieon Hacker News • Mentions
On “Iran forged the wrong SSL certificate”
The problem is that right now, in the common case, the browser/OS vendors can't black-list individual CAs. Their ability to do so with DigiNotar is exceptionally rare, and would not be possible most of the time. Trust agility ensures that clients have the ability to make these trust decisions easily. A client does not necessarily have to be a user , it could still be the browser/OS vendors. For details on how Convergence works, in order to answer your question of how it prevents 1/4th of the SSL internet from going down when Comodo gets hacked, the best reference is (unfortunately) still the presentation: link to this video
burgerbrainon Hacker News • Mentions
On “DigiNotar root CA trust removal follow-up”
Comodo had huge issues very recently, and VeriSign's issues go back about as far as they do (providing intercept services to governments. That wasn't even an 'accident'.) Godaddy? I don't know much about what they do but I wager you wouldn't have to dig deep. Edit: I'm not the only one saying this: link to this video Modding me down will not restore the trust.
espeedon Hacker News • Mentions
On “Switch to HTTPS Now, For Free”
Using encrypted tokens help mitigate stolen session IDs ( link ). And while HSTS helps protect against sslstrip, you're still vulnerable to MITM attacks due to issues with the CA system. See moxie's 2011 talk "SSL and the Future of Authenticity" ( link to this video )
atmosxon Hacker News • Mentions
On “Did this Tor developer become a victim of NSA's laptop interception program?”
…ntil it’s too late. They both get easily crashed, without putting up a fight. So you can play naive , stupid , stunned or cunning all you like but human history is FULL of stupid people in position of power. 1 Quora: “Does the NSA have better engineers than Facebook or Google?”: link 2 “BlackHat USA 2011: SSL And The Future Of Authenticity”: link to this video 3 “K. Alexander lies to congress” - link…