Weakest Link

on YouTube ↗19m

" summary

Argues the real weakest link is private keys and demonstrates it by measured TLS connection times from multiple continents to infer where keys live, finding Amazon appears singular while Google/Facebook show at least four distinct locations. Quantifies risk — a hundred thousand copies implies ~10% chance of compromise, a million ~63% — and shows the measurement yields those patterns. Recommends hardware protection like HSMs or smart cards never expose private keys to prevent copying.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 3:41What happens to your trust when you know that there are copies of your door key?
3. 6:07PHYSICAL copies do not scale. DIGITAL copies scale. And every copy is perfect!
4. 9:19How do we detect copies of private keys from the outside?
5. 9:31Measure: TLS handshake time
6. 12:09Q.E.D. THERE ARE COPIES OF KEYS!
7. 12:23Q.E.D THERE ARE COPIES OF KEYS!
8. 15:32CA Certificates PKI are only built to maintain the integrity of the public keys!
9. 15:54The integrity of the private key is untouched by the CA/PKI infrastructure
10. 16:20Conclusion: THE WEAKEST LINK is THE PRIVATE KEY of our partner
11. 16:56QUESTION: Is there a solution to maintain the private keys integrity along the PKI implementations?

" related talks

• 26mThe Software Not the Human Is the Weakest LinkBrenno De Winter · OWASP AppSec Research (AppSecEU) 2015
• 14mWhen Encryption FailsEva Summerfield · BSides London 2021
• 28mWhen the Weakest Link is Strong...Susan E. McGregor, Franziska Roesner, Elizabeth Anne Watkins, Mahdi Nasrullah Al-Ameen, Kelly Caine · 26th USENIX Security Symposium (USENIX Security '17)
• 44mHumans as the Weakest LinkMarina Francisco Veintimilla · T3chFest 2023
• 52mPrivacy & Security, Policy & TechnologyTim Bray · GOTO Copenhagen 2014
• 40m"It Me": Under the Hood of Web AuthenticationYan Zhu, Garrett Robinson · Strange Loop 2017
• 28mThe Million-Key Question—Investigating the Origins of RSA Public KeysPetr Švenda, Matúš Nemec, Peter Sekan, Rudolf Kvašňovský, David Formánek, David Komárek, Vashek Matyáš · USENIX Security '16
• 01h 26mTLS Cryptography for ProgrammersPeter Bindels · ACCU 2022