DEFCON 17: More Tricks For Defeating SSL – YouTube
Posted by jpluimers on 2016/07/11
Still relevant after a few years: DEFCON 17: More Tricks For Defeating SSL – YouTube.
I landed there after trying to find out how to verify the Internic root server file is actually pubished by Internic via authentication – Ways to sign gpg public key so it is trusted? – Information Security Stack Exchange.
I remember reading his “if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom” post (Moxie Marlinspike >> Blog >> The Cryptographic Doom Principle), but never noticed his videos.
It is still relevant as there are lots of implementations still vulnerable to these kinds of attacks.
Many more of his blog entries are interesting as well:
- Moxie Marlinspike >> Blog >> Your app shouldn’t suffer SSL’s problems.
- Moxie Marlinspike >> Blog >> We Should All Have Something To Hide.
- Moxie Marlinspike >> Blog >> sslsniff: Anniversary Edition.
- Moxie Marlinspike >> Blog >> SSL And the Future Of Authenticity which leads to Convergence | Beta and another video:
More recent videos:
Finally be sure to read his short stories. Mostly non-tech related. Some terrifying, some amusing. Good reads: Moxie Marlinspike >> Stories.
–jeroen
Moxie Marlinspike aka Matthew Rosenfeld aka Mike Benham
The Wiert Corner - irregular stream of stuff 
Leave a comment