kttaSep 2017Strongly recommends
Relevant part starts here ▶ this video Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.
in “Broadening HSTS to secure more of the Web” · View on HN
Defeating Ssl Using Sslstrip (Marlinspike Blackhat)
Defeating Ssl Using Sslstrip (Marlinspike Blackhat) on HackerTube: recommended by 3 Hacker News commenters across 3 separate months, 2014–2018.
TheSecurityTube
Open on YouTubetalk · intermediate · evergreen
Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.
Why Hacker News recommends it
HN recommends it as an entertaining talk and the original source on the stripping attack that motivated HSTS.
- people recommended it
- 3
- separate months
- 3
- strong recommendations
- 1
- discussed on HN
- 2014–2018
“Very entertaining.”
What HN commenters said
7 Hacker News comments link this video. Each one links back to its thread.
superuser2Sep 2015Recommends
We don't have humans in the loop for issuing certificate; this can and has been exploited for fun and profit, with fun attacks like getting a cert for "citibank.com\0.mydomain.com" which used to trick the C strcmp in most browser certificate checking routines. Moxie has an entertaining talk: ▶ this video Your problem would be getting people to "thecitibank.com." Chrome, Firefox, and GMail would all eventually figure out it was a phishing site and warn users about clicking through to it.
in “Our First Certificate Is Now Live” · View on HN
fabulistNov 2014Recommends
This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: Tricks for Defeating SSL in Practice - Moxie Marlinspike ▶ this video OPSEC: Because Jail is for wuftpd - thegrugq [link]
in “How to Learn Hacking” · View on HN
CydeWeysJan 2018Cites it
History lesson incoming: ▶ this video The only effective way to get guaranteed security is with HSTS preloading. Anything short of that leaves you vulnerable to the linked attack, which dates way back to 2012.
in “Alibaba’s UC Browser is dominating in Asian markets with lower-end smartphones” · View on HN
schoenSep 2017Cites it
> How viable is the interception a http-to-https redirect page? It can be very powerful if done maliciously: ▶ this video (This kind of attack is a primary motivation for the existence of HSTS.)
in “Broadening HSTS to secure more of the Web” · View on HN
sgentleNov 2016Cites it
If it helps, the attack you're describing is called sslstrip and was presented by Moxie Marlinspike at Black Hat in 2009: ▶ this video (code here: [link] ) As others have mentioned, the current best defence against this is HSTS (and, in particular, HSTS preloading). I think the best explanation of it is here: [link]
in “Here’s to more HTTPS on the web” · View on HN
Show 1 more comment
sammanOct 2014Cites it
Perhaps one of the techniques discussed here: ▶ this video ? Or, as this was published a couple of days ago, it might have utilized POODLE, or even BEAST in unmitigated cases. But yeah, I'd also believe user error in some cases.
in “Why public WiFi is dangerous” · View on HN
Topics & tags
Security & hackingNetworking & internet infrastructureCryptographysslstripmoxie marlinspikehttpshstsblack hat