DEFCONConference
4 HN recommenders · recommended in 7 months, 2013–2026
46:22 · 11K views · Nov 2, 2013
Moxie Marlinspike's DEF CON 19 talk on the weaknesses of SSL and the certificate authority system. He explains how CA trust became a problem and proposes an alternative that removes the CA oligopoly without reducing security.
HN points to it as the classic overview of why TLS certificate trust is flawed, and it resurfaces whenever CA or HTTPS security comes up.
8 comments from Hacker News
"Often hear that the reason today’s Internet is not more secure is that the early designers failed to imagine that security could ever matter." Related to this, you should definitely watch Moxie Marlinspike's (lead dev of Signal) talk where he tells about his discussion with Kipp Hickman, a developer of SSL: this video (until 16:33)
I've found Moxie Marlinspike's talk [1] to be a great overview of these sorts of issues. IIRC, he built an alternate system discussed in the talk. But I believe that's defunct. (Tangent, anyone know the postmortem on that?) this video
Whenever I hear statements like "incredibly complex and sophisticated attack" I'm reminded of the 2011 Comodo (now Sectigo) hack where the company said it had "clinical accuracy" and "likely to be a [Iranian] state-driven attack". Days later, the perpetrator released a "manifesto" (and several other documents) all but confirming that it was the work of a lucky amateur. Moxie (of Signal fame) has a hilarious account of the story in his 2011 Blackhat talk "SSL and the future of authenticity" (starts at around 5:00): this video
Moxie has good points about the problems TLS has. And they are not about breaking TLS via cryptanalysis: this video
> One of Web PKI's security holes is the fact that any CA can issue valid certs for any domain. The only official "mitigation" for that is voluntary and can be defeated. In case you were not aware, Moxie Marlinspike spoke about this at length back in the early 2010s[1]. His view was that the problem is that certificate authority trust is controlled by the wrong people (web hosts, not users -- or browsers, as a proxy for user wishes) and is not possible to revoke because once a web host uses a particular CA you are stuck trusting them forever otherwise the internet will break. > The solution to that is to rearchitect the Web PKI ecosystem to use domain registrars as the sole source of truth for which CA is allowed to issue valid certs, in addition to cryptographic fingerprints of the source of the originator and issuer. I won't rehash it here but it's not technically difficult and would make it so only the domain owner could issue certs, and valid certs could only come from the CA the domain owner authorizes. Unfortunately, this is problematic for a bunch of other reasons. Yes, this means that a classic Comodo or DigiNotar attack might be blocked (though it is also just as likely they would've been included on the allow-list for American websites), but it also means that registrars could force you to use VeriSign and you would have no choice in the matter -- that is what originally happened with TLS and was what originally happened with DNSSEC too. It seems prudent to me to av