BlackHat USA 2011: SSL And The Future Of Authenticity

Speaker: MOXIE MARLINSPIKE

In the early 90's, at the dawn of the World Wide Web, some engineers at Netscape developed a protocol for making secure HTTP requests, and what they came up with was called SSL. Given the relatively scarce body of knowledge concerning secure protocols at the time, as well the intense pressure that everyone at Netscape was working under, their efforts can only be seen as incredibly heroic. But while it's amazing that SSL has endured for as long as it has, some parts of it -- particularly those concerning Certificate Authorities -- have always caused some friction, and have more recently started to cause real problems.

This talk will provide an in-depth examination of the current problems with authenticity in SSL, discuss some of the recent high-profile SSL infrastructure attacks in detail, and cover some potential strategies for the future. It will conclude with a software release that aims to definitively fix the disintegrating trust relationships at the core of this fundamental protocol.

For more information or download the video visit: http://bit.ly/BlackHat_USA_2011_infor...

• Category

  Science & Technology

[jeroeniskoning]

Please people, listen to this genius !

[DanielMarschall]

He didn't explain how the connections to the notaries are secured... this would have been very interesting and this is probably the weak point of Convergence. Are the notaries secured by a CA signature? How do I know which notaries I should trust? And how do I get their public keys in a secure way? Is the list of default notaries really secure?

[jessebickeldotcom]

The notary certificate is included in the "bundle" that a user chooses. The bundle is the means of communicating trust of a notary to the user agent. Take a look at server/convergence-bundle.py in moxie0's github account.

[Cocodrilo92]

Most likely

[Hans-Henrik Stærfeldt]

Risking repeating a good point to sound clever. But this is a good point!

Are traffic to the notaries subject to man-in-the-middle attacks?

[greg ferreira]

thought i was smart til i listened to this, holy shit!!!

[DarkVideo007]

I love his intro!! xD

so funny

[Frederik Pedersen]

Why this not for chrome ?

[someman7]

I wouldn't know, you could perhaps check the author's website or e-mail him.

[Andrei Petcu]

No h t t p s on convergence!

Is the project dead? No more commits in the last 8 months. The project is still in beta?

[someman7]

.io? Are you kidding me? Dude.