There has been a fair amount of effort on UCAN (User Controlled Authorization Networks), and other types of ‘decentralized credentials’ over the last couple years. These efforts perpetuate the same control structures that exist today, with delegated trees of hierarchical control. This is in contrast to a personal or ‘decentralized’ trust we might hope for… Continue reading On Trust
Category: Security
Computer Security Related topics
What's Left for private Messaging
I had the privilege to address the annual Chaos Communication Congress (36C3) in Leipzig last week about the state and remaining issues in private communications. The recording of the video has been made available by the CCC, and I have also posted the slides. The TL;DR for me is that many of the trade-offs are… Continue reading What's Left for private Messaging
Messaging Threat models
I talked yesterday at Bornhack about the current state of secure messaging and the different primitives and threats that groups are working to address. The talk is on youtube. The slides are on this site, as are the directions for dogfooding the talek system.
I’ll be talking at Linux Fest Northwest in a couple weeks.
IETF 98
Last week I talked briefly about the state of open internet measurement for network anomalies at IETF 98. This was my first time attending an IETF in-person meeting, and it was very useful in getting a better understanding of how to navigate the standards process, how it’s used by others, and what value can be… Continue reading IETF 98
Another Strike against Domain Fronting
In 2014, Domain Fronting became the newest obfuscation technique for covert, difficult to censor communication. Even today, the Meek Pluggable transport serves ~400GB of Tor traffic each day, at a cost of ~$3000/month. The basic technique is to make an HTTPS connection to the CDN directly, and then once the encryption has begun, make the… Continue reading Another Strike against Domain Fronting
Thoughts on IPv6 Measurement
About five years ago two projects, Zmap and Masscan, helped to shift the way that many researchers thought about the Internet. The tools both provide a relatively optimized code path for sending packets and collecting replies, and allow a researcher with moderate resources to attempt connections to every computer on the IPv4 Internet in about… Continue reading Thoughts on IPv6 Measurement
First-party Google Analytics
Third party analytics services are suffering from the growing prevalence of ad blocking, tracking protection, and the trend of minimizing connections and requests. However, from a site owner perspective, receiving usage information remains important for measuring site growth. My expectation is that we are already on the curve where ads and tracking software will be… Continue reading First-party Google Analytics
Watch your PAC
In the last week at Blackhat / Defcon two groups looked deeply at one of the lesser known implementations of network policy called Proxy Autoconfig. (In particular, badWPAD by Maxim and Crippling HTTPS with unholy PAC by Safebreach.) Proxy AutoConfig (PAC) is a mechanism used by many organizations to configure an advanced policy for connecting… Continue reading Watch your PAC
Excited to see Satellite chosen as best student paper this year at USENIX ATC. Slides and audio from the talk should be online shortly.
The CS department, as always, is on top of its news releases.