Top all-time · #1758
J. Alex Halderman
Personal blog · jhalderm.com · on HN as schoensecurityscience
J. Alex Halderman's personal blog at jhalderm.com covers security and science. Since 2012, 44 different Hacker News readers have linked it 51 times, most often “The Security Impact of HTTPS Interception [pdf]”. No feed was found, so read it on the site itself.
J. Alex Halderman, professor of computer science and engineering at the University of Michigan
Most-linked posts?
- The Security Impact of HTTPS Interception [pdf]8 people · 8 mentions · first linked 2017-01-26
- Attacking the Washington, D.C. Internet Voting System7 people · 8 mentions · first linked 2012-03-02
- Security Analysis of the Estonian Internet Voting System [pdf]7 people · 8 mentions · first linked 2015-03-11
- Let's Encrypt: An Automated CertificateAuthority to Encrypt the Entire Web [pdf]4 people · 4 mentions · first linked 2019-11-12
- Crawling BitTorrent DHTs for Fun and Profit (2010) [pdf]4 people · 4 mentions · first linked 2013-03-24
- /3 people · 3 mentions · first linked 2015-03-13
- Security Analysis of India’s Electronic Voting Machines (2010) [pdf]2 people · 2 mentions · first linked 2015-08-18
- Green Lights Forever: Analyzing the Security of the Traffic Infrastructure [pdf]2 people · 2 mentions · first linked 2014-08-21
- Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice2 people · 2 mentions · first linked 2018-12-20
- PAC-MAN on the Sequoia AVC-Edge DRE Voting Machine2 people · 2 mentions · first linked 2016-08-13
What Hacker News says?
For reference The code is here: https://github.com/caddyserver/caddy/blob/master/caddyhttp/h... The paper: https://jhalderm.com/pub/papers/interception-ndss17.pdf
Comment linking /pub/papers/interception-ndss17.pdf
on “MITM on HTTPS traffic in Kazakhstan”Submitted The Security Impact of HTTPS Interception [pdf] as a story · 160 points
HN discussionIt's worth reading the paper: https://jhalderm.com/pub/papers/letsencrypt-ccs19.pdf I don't think this is just about having money and funding, it's a very careful and tactical approach. Agree it would be nice if we find and capitalize on opportunities like this, but (to me) it would be hard to run an email provider with the operational goals they list: - Minimal logic - Minimal data - Full automation - Functional is…
Comment linking /pub/papers/letsencrypt-ccs19.pdf
on “Let's Encrypt Has Issued a Billion Certificates”Submitted Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice as a story · 69 points
HN discussionWe recently published a paper on this exact issue and quantify the degree to which AV / corporate middlebox systems degrade the security of HTTPS connections. The tl;dr is that we find an alarming amount of MITM on the public internet (5-10%), mostly due to AV/middleboxes, and they almost always degrade the security of the connection. * https://jhalderm.com/pub/papers/interception-ndss17.pdf
Comment linking /pub/papers/interception-ndss17.pdf
on “Avoid Non-Microsoft Antivirus Software”Submitted Crawling BitTorrent DHTs for Fun and Profit (2010) [pdf] as a story · 55 points
HN discussionhttps://jhalderm.com/pub/papers/ipmi-woot13.pdf suggests one (fairly visible) way: > Another common feature is virtual USB disk media, which can be used to infiltrate or exfiltrate files or to provide new boot media. The combination of these capabilities and remote power cycling would allow an attacker to seize control of most common server configurations. For instance, they could restart the system and boot from a…
Comment linking /pub/papers/ipmi-woot13.pdf
on “The Big Hack: Statements From Amazon, Apple, Supermicro, Chinese Government”Submitted Let's Encrypt: An Automated CertificateAuthority to Encrypt the Entire Web [pdf] as a story · 25 points
HN discussionProfessor Alex Halderman from Michigan has performed a few studies on Electronic Voting and Electronic Voting Machines, and essentially has proven that it is insecure. At one point, he hacked an American EVM to play the Michigan Fight song on every submission. You can read a few of his papers here: [1][2] The challenge of creating anonymous and secure voting systems is still an area of constant research, and I do no…
Comment linking /pub/papers/voting-wecsr11.pdf
on “Software used to count Australian Senate votes is a “trade secret””Submitted Attacking the Washington, D.C. Internet Voting System as a story · 9 points
HN discussionThey also will often install their own trusted root certificate and then MITM all HTTP/HTTPS connections. Often, this MITM will significantly reduce the cryptographic security of the connection over the public internet [1]. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf
Comment linking /pub/papers/interception-ndss17.pdf
on “Mozilla and Opera remove Avast extensions from their add-on stores”Submitted Green Lights Forever: Analyzing the Security of the Traffic Infrastructure [pdf] as a story · 8 points
HN discussionElectronic voting machines used in Indian elections are custom built for the purpose, and cost about $100. https://en.wikipedia.org/wiki/Indian_voting_machines All it has is N buttons, accumulators to store presses of each button in non-volatile memory, and a seven-segment LED display to indicate status (ready-to-vote, vote cast, etc.). Vote counting is done offline by connecting to a controller. No wifi or any othe…
Comment linking /pub/papers/evm-ccs10.pdf
on “Decertifying the worst voting machine in the US”Submitted Security Analysis of India’s Electronic Voting Machines (2010) [pdf] as a story · 4 points
HN discussionThere was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/papers/interception-ndss17.pdf How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the flo…
Comment linking /pub/papers/interception-ndss17.pdf
on “BlueCoat and other proxies hang up during TLS 1.3”Submitted PAC-MAN on the Sequoia AVC-Edge DRE Voting Machine as a story · 3 points
HN discussionThere is a fantastic paper on how these proxies often lower security: "The Security Impact of HTTPS Interception" [1]. The paper also provides some interesting ways of detecting this type of proxy on the server (and client too - although a client should know if they have custom trusted certs). mitm.watch has implemented the details of the paper. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf [2] https:/…
Comment linking /pub/papers/interception-ndss17.pdf
on “Why should I use DuckDuckGo instead of Google?”Submitted Security Analysis of the Estonian Internet Voting System [pdf] as a story · 3 points
HN discussionIt has its own problems: https://jhalderm.com/pub/papers/ivoting-ccs14.pdf
Comment linking /pub/papers/ivoting-ccs14.pdf
on “To Know If the Election Was Hacked, Look at the Ballots”Submitted Security Analysis of the Estonian Internet Voting System (2014) [pdf] as a story · 2 points
HN discussionHalderman is a computer security professor at UofM: https://jhalderm.com/
Comment linking /
on “To Know If the Election Was Hacked, Look at the Ballots”Submitted Attacking the Washington, D.C. Internet Voting System [pdf] as a story · 2 points
HN discussionNot to mention voting online - yes, Estonia does this, and it's as insecure as you'd imagine [0]. [0]: [pdf] https://jhalderm.com/pub/papers/ivoting-ccs14.pdf
Comment linking /pub/papers/ivoting-ccs14.pdf
on “Infineon RSA Key Generation Issue”Submitted Security Analysis of the Estonian Internet Voting System [2014, pdf] as a story · 2 points
HN discussionWe briefly describe this history on page 6 of https://jhalderm.com/pub/papers/letsencrypt-ccs19.pdf in case anyone is more interested (there are also references there for further details). Twice, methods that seemed plausible for proving control over domain names turned out to make assumptions that were potentially violated by shared hosting environments. Jacques, I'm really sorry for the hassle that these changes c…
Comment linking /pub/papers/letsencrypt-ccs19.pdf
on “Letsencrypt, the Good, the Bad and the Ugly”Submitted PAC-MAN on the Sequoia AVC-Edge DRE Voting Machine as a story · 2 points
HN discussion> I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole. This is the usual reaction to this I see everywhere. It doesn't match with reality. Read the complete paper by Halderman et al [1]. It says pretty clearly that all existing products lower the security in one way or another: "Our grading scale focuses on t…
Comment linking /pub/papers/interception-ndss17.pdf
on “HTTPS Interception Weakens TLS Security”Submitted Attacking the Washington, D.C. Internet Voting System (2012) [pdf] as a story · 1 points
HN discussionSure, apt is secure. However, I don't think that's what's being discussed. If I remember correctly, the researchers were complaining about how Linux ISOs were downloaded, not packages . (The writer of the rebuttal seems to be confusing these, which is, again, concerning.) To quote their paper: > Despite procedural safeguards, an attacker who strikes early enough can introduce malicious code into the counting server…
Comment linking /pub/papers/ivoting-ccs14.pdf
on “Why Online Voting Is a Danger to Democracy”Submitted Attacking the Washington, D.C. Internet Voting System as a story · 1 points
HN discussion
