SSL and the Future of Authenticity
Moxie Marlinspike explores ssl and the future of authenticity at DEF CON 19, examining digital-rights and practical defenses.
Summary
Architecture and Background
Moxie Marlinspike - SSL And The Future Of Authenticity In the early 90's, at the dawn of the World Wide Web, some engineers at Netscape developed a protocol for making secure HTTP requests, and what they came up with was called SSL.
Vulnerability Analysis
Given the relatively scarce body of knowledge concerning secure protocols at the time, as well the intense pressure that everyone at Netscape was working under, their efforts can only be seen as incredibly heroic.
Exploitation and Demonstrations
But while it's amazing that SSL has endured for as long as it has, some parts of it -- particularly those concerning Certificate Authorities -- have always caused some friction, and have recently started to cause real problems.
Remediation and Defensive Strategies
This talk will examine authenticity within SSL, shed new light on the current problems, and cover some new strategies for how to move forward.
Related talks
Main Stage·52 min
Amber Baldet
Amber Baldet explores suicide risk assessment and intervention tactics at DEF CON 21, examining digital-rights and practical defenses.
Main Stage·48 min
Alexandre Pinto
Alexandre Pinto explores defending networks with incomplete information at DEF CON 21, examining digital-rights and practical defenses.
Main Stage·49 min
Alejandro Caceres
Alejandro Caceres details conducting massive attacks with open source distributed computing ALEJANDRO CACERES OWNER, HYPERION GRAY LLC Distributed computing is sexy.