THE VIDEO SHELF · ssl stripping attacks

Defeating Ssl Using Sslstrip (Marlinspike Blackhat)

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

Why HN readers recommended it

HN recommends it as an entertaining talk and the original source on the stripping attack that motivated HSTS.

This is a summary from the source dataset, not an endorsement by Hacker News or the video creator.

These counts and years describe the included Hacker News records; they are not YouTube views or the video’s publication date.

Excerpts from the recorded comments. Follow each source for the full comment and surrounding discussion.

Relevant part starts here [VIDEO] Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.
ktta on Hacker News · 2017-09
In Broadening HSTS to secure more of the Web
This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: …
fabulist on Hacker News · 2014-11
In How to Learn Hacking
We don't have humans in the loop for issuing certificate; this can and has been exploited for fun and profit, with fun attacks like getting a cert for "citibank.com\0.mydomain.com" which used to trick the C strcmp in most browser certificate checking routines. Moxie has an …
superuser2 on Hacker News · 2015-09
In Our First Certificate Is Now Live

Summaries, classifications and recommendation records are from the HackerTube source dataset. Read about this library and its limitations.