20 Hacker News comments link this video. Each one links back to its thread.
rakooNov 2013Strongly recommends
Perspectives/Convergence really is a great system, but it unfortunately still has several problems: - it completely leaks your browsing history: you basically ask a notary "what's the certificate you see for kinkyneighbors.com?". Convergence addresses this, though - it requires network-heavy intermediaries for all the browsing of all the people around the world. - it still doesn't solve authenticity: an attacker could very well be controlling all connections arriving at your house, or leaving the target's server, and fool everyone Convergence/Perspectives should be coupled with certificate pinning, aka storing _really_ trusted authorities (ie verified by hand) on your computer. Guess what ? [Moxie's next project is just that [0] (For anyone curious, I highly recommend Moxie's talk [1] about Convergence, it does a great job at explaining what's the problem, what's Convergence and how it can solve at least part of it) [0] [link] [1] ▶ this video
in “Moving forward on improving HTTP's security” · View on HN
JonnieCacheNov 2011Strongly recommends
Yeah, I edited my list to include a CA-free encrypted replacement for TCP, just before I saw your comment. To all the super-geniuses reading this: burn your socialmobilelocal startup to the ground tomorrow and do this instead. Start by watching this Blackhat talk I linked elsewhere in the thread, the guy has the right kind of ideas: ▶ this video
in “US judge orders hundreds of sites "de-indexed" from Google, Facebook” · View on HN
Show 14 more comments
jcaseJan 2013Recommends
Some developments in this area are: * Convergence.io * DNS-based Authentication of Named Entities (DANE) + DNSSEC * Tack.io For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers. On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can: "CAs are sketchy, but this is a whole new world of sketchiness. Think, sketchasaurus. Registrars were never built or selected with security in mind, and most of them don’t have a very good track record in this area. Shouldn’t it be laughable that the current first step in deploying DNSSEC is to create an account with GoDaddy?"[2] The 2011 BlackHat video[3] and blog post[2] by Moxie Marlinspike are great sources of information. IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains. [1] [link] [2] [link] [3] ▶ this video
in “Enhancing digital certificate security (Fake *.Google.com cert issued)” · View on HN
aleccoNov 2011Recommends
How does this solution deal with the "Citibank problem"? (a website with a huge number of SSL keys from multiple certificate authorities) A great talk from last DefCon ▶ this video
in “The Sovereign Keys Project” · View on HN
jvc26Sep 2011Recommends
▶ this video The original Comodo attack was discussed by Moxie Marlinspike at Blackhat USA 2011 - quite an interesting discussion on the issue.
in “Diginotar and Comodo hacker the same guy and claims to have owned 4 other CAs” · View on HN
anonbankerAug 2016Cites it
Moxie's "SSL is a joke"[0] talk in 2011 keeps staying relevant after all these years. 0. ▶ this video
in “New attack steals SSNs, e-mail addresses, and more from HTTPS pages” · View on HN
_jomoAug 2016Cites it
I wonder why moxie's Convergence [0] didn't take off. To me it sounds near-perfect. It could handle multiple layers of authenticity, including DNS. The project has been inactive on GitHub for 5 years [1], however the Namecoin project picked it up [2] as "FreeSpeechMe" and added support for IPv6, and .bit, .onion, .b32.i2p domains. Now this, too, has been discontinued "because Mozilla removed the relevant API's as of Firefox 33". They "intend to release a replacement soon". According to Jeremy Rand [3] "A replacement is in the works (and is mostly working already)", but the source doesn't seem to be public or I can't find it. Are there any downsides of Convergence? 0: ▶ this video 1: [link] 2: [link] 3: [link]
in “The DNSSEC master key securing DNS is about to change” · View on HN
ymseJun 2016Cites it
> They issued fraudulent SSL certificates in 2011: [link] Moxie had an amusing anecdote about this incident in his Blackhat 2011 talk "SSL and the future of authenticity"[0]. Apparently the same IP as was used by the "sophisticated attacker" and disclosed by Comodo downloaded sslsniff[1] from moxies server the next day, referred by a video tutorial about intercepting SSL.. 0: ▶ this video 1: [link]
in “Defending Our Brand” · View on HN
dobbsbobApr 2014Cites it
I would say they are compromised just by watching Moxie Marlinspike's presentation about the shitty state of CAs and how he was able to find signing certs just laying around in unprotected directories ▶ this video
in “Were Intelligence Agencies Using Heartbleed in November 2013?” · View on HN
sarahjApr 2014Cites it
Why have a single entity at all? Moxie Marlinspike proposed Convergence ( ▶ this video ) as a solution - I think that something like that has far more potential wheels to travel than a Namecoin based system. I should be able to choose who I trust, a notary system would allow me to do just that. No central CA systems. The biggest concern I can see is Identity management, but, as mentioned by Moxie, most of these CA don't do anything close to proper Identity management any more - I have a number of certificates bought from quite a few different CA's all made out to my rabbit, at no fixed address. Notaries can, of course, do additional verification - they could even advertise this as a premium. I don't see why this can't be extended to DNS lookup's either. I trust X notaries and pin the results I get, I can choose to trust a majority, or be hyper paranoid and require everyone to agree. No need to run a power hungry blockchain, no single point of technology failure. Technically, all of that is feasible today. And I imagine we will see a number of different technologies combined to form a proper, decentralised, system.
in “No, don't enable revocation checking” · View on HN
atmosxJan 2014Cites it
You are either stupid or subversive. By now we all know Keith Alexander’s view of hackers (socially disabled, semi-autistic kids sitting behind a laptop at 4 a.m. wearing a batman suit and gloves) and his view on technical matters is equal with Comodo’s [2] leader. As for NSA having skilled personnel??? Sure - some of them are skilled - but they don’t take decisions[1]. The stupid guys do (again, K. Alexander is an excellent reference for incompetence add to that that he is a lier[3] and you’ ve got an explosive mix). NOTE: In “War and Peace” - Tolstoy’s masterpiece - there’s a Russian officer (Prince Andrey IIRC) who realizes the insane tragedy of human history: While the Prussian and Russian army coalition (hundreds of thousands of men, with families and lives left behind…) is about to face the fiercest opponent of their era (Napoleon, is a legend among Russian military officials) the two Generals (Prussian and Russian) are fighting and sabotaging each other about who is going to lead the battle… Until it’s too late. They both get easily crashed, without putting up a fight. So you can play naive , stupid , stunned or cunning all you like but human history is FULL of stupid people in position of power. [1] Quora: “Does the NSA have better engineers than Facebook or Google?”: [link] [2] “BlackHat USA 2011: SSL And The Future Of Authenticity”: ▶ this video [3] “K. Alexander lies to congress” - [link]
in “Did this Tor developer become a victim of NSA's laptop interception program?” · View on HN
espeedSep 2013Cites it
Using encrypted tokens help mitigate stolen session IDs ( [link] ). And while HSTS helps protect against sslstrip, you're still vulnerable to MITM attacks due to issues with the CA system. See moxie's 2011 talk "SSL and the Future of Authenticity" ( ▶ this video )
in “Switch to HTTPS Now, For Free” · View on HN
derridaSep 2011Cites it
It is indeed based on Perspectives. But the implementation provided with Perspectives does not have privacy. If you contact a notary with Perspectives then that notary has your browsing history. See 36:50 on ▶ this video
in “Iran forged the wrong SSL certificate” · View on HN
moxieSep 2011Cites it
The problem is that right now, in the common case, the browser/OS vendors can't black-list individual CAs. Their ability to do so with DigiNotar is exceptionally rare, and would not be possible most of the time. Trust agility ensures that clients have the ability to make these trust decisions easily. A client does not necessarily have to be a user , it could still be the browser/OS vendors. For details on how Convergence works, in order to answer your question of how it prevents 1/4th of the SSL internet from going down when Comodo gets hacked, the best reference is (unfortunately) still the presentation: ▶ this video
in “Iran forged the wrong SSL certificate” · View on HN
burgerbrainSep 2011Cites it
Comodo had huge issues very recently, and VeriSign's issues go back about as far as they do (providing intercept services to governments. That wasn't even an 'accident'.) Godaddy? I don't know much about what they do but I wager you wouldn't have to dig deep. Edit: I'm not the only one saying this: ▶ this video Modding me down will not restore the trust.
in “DigiNotar root CA trust removal follow-up” · View on HN
DonHopkinsSep 2017Critical
Wow, I missed that story the first time around. Just catching up on the details. That Comodo CEO Melih Abdulhayoğlu is such a dishonest, incompetent buffoon! I had no idea how terrible a company Comodo is, but now I do thanks to the CEO's own words and actions. ▶ this video
in “Gnu Privacy Guard relies on one underfunded person (2015)” · View on HN