BlackHat USA 2011: SSL And The Future Of Authenticity
Why Hacker News recommends it
HN commenters repeatedly recommend it as the best explanation of why the CA system is broken and what alternatives exist.
What it is
Moxie Marlinspike's BlackHat 2011 talk examines weaknesses of SSL and the certificate authority system and proposes Convergence, a decentralized notary approach with trust agility.
Recommended by 9 HN commenters across 7 different months, 2011 to 2017.
What Hacker News said
Strong rec jtdowney · 2011-09 · on “Convergence, distributed, secure strategy replacing certificate authorities”
Moxie Marlinspike is the creator of Convergence. I highly recommend watching his Blackhat 2011 talk ( [this video] ) covering authenticity on the web and Convergence.
Strong rec JonnieCache · 2011-11 · on “US judge orders hundreds of sites "de-indexed" from Google, Facebook”
Yeah, I edited my list to include a CA-free encrypted replacement for TCP, just before I saw your comment. To all the super-geniuses reading this: burn your socialmobilelocal startup to the ground tomorrow and do this instead. Start by watching this Blackhat talk I linked elsewhere in the thread, the guy has the right kind of ideas: [this video]
Strong rec 4ad · 2012-06 · on “Setting out plans to monitor all Internet use in the UK”
Businesses (and governments) can legitimately buy root keys that allow MITMing any SSL connection or they could just be a CA themselves (any CA can MITM the whole internet). Here's the best talk I know of this subject: BlackHat USA 2011: SSL And The Future Of Authenticity: [this video]
Strong rec rakoo · 2013-11 · on “Moving forward on improving HTTP's security”
Perspectives/Convergence really is a great system, but it unfortunately still has several problems: - it completely leaks your browsing history: you basically ask a notary "what's the certificate you see for kinkyneighbors.com?". Convergence addresses this, though - it requires network-heavy intermediaries for all the browsing of all the people around the world. - it still doesn't solve authenticity: an attacker could very well be controlling all connections arriving at your house, or leaving the target's server, and fool everyone Convergence/Perspectives should be coupled with certificate pinning, aka storing _really_ trusted authorities (ie verified by hand) on your computer. Guess what ?
Recommends jvc26 · 2011-09 · on “Diginotar and Comodo hacker the same guy and claims to have owned 4 other CAs”
[this video] The original Comodo attack was discussed by Moxie Marlinspike at Blackhat USA 2011 - quite an interesting discussion on the issue.
Recommends alecco · 2011-11 · on “The Sovereign Keys Project”
How does this solution deal with the "Citibank problem"? (a website with a huge number of SSL keys from multiple certificate authorities) A great talk from last DefCon [this video]
Recommends jcase · 2013-01 · on “Enhancing digital certificate security (Fake *.Google.com cert issued)”
Some developments in this area are: * Convergence.io * DNS-based Authentication of Named Entities (DANE) + DNSSEC * Tack.io For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers. On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can: "CAs are sketchy, but this is a whole new world of sketchiness. Think, sketchasaurus. Registrars were never built or selected with security in mind, and most of them don’t have a very good track record in this area. Shouldn’t it be laughable that the current first step in deploying DNSSEC is to create an account with GoDad
Recommends glass- · 2015-10 · on “Sustaining Digital Certificate Security”
Convergence was the perfect replacement, but it never gained any traction. Moxie's talk at BlackHat[0] introducing it is a good watch for those unfamiliar with the idea, and if you want to be wistfully frustrated at what could have been. [0] [this video]