Top all-time · #376
Moxie Marlinspike
Personal blog · thoughtcrime.orgsecuritypolitics
Moxie Marlinspike is a personal blog at thoughtcrime.org about security and politics. Since 2009, 142 different Hacker News readers have linked it 171 times, most often “A Crypto Challenge For The Telegram Developers”. The last post was in 2024, but the archive is still widely read.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
HN readers link his posts on why SSL's authenticity model fails, the Lavabit server design and the Telegram crypto challenge, and point to his software pages such as sslstrip.
- Recommended for · 7 comments
- Called worth a read or recommended reading; one loved Money Machine; one says Moxie 'eloquently captured' the point.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hard to say.
Most-linked posts?
- /software/sslstrip/28 people · 29 mentions · first linked 2009-06-28
- A Crypto Challenge For The Telegram Developers15 people · 15 mentions · first linked 2013-12-19
- A Critique of Lavabit12 people · 12 mentions · first linked 2013-11-05
- The Cryptographic Doom Principle10 people · 11 mentions · first linked 2012-11-13
- We Should All Have Something To Hide10 people · 11 mentions · first linked 2013-06-12
- GPG and Me10 people · 10 mentions · first linked 2015-02-24
- Knock Knock10 people · 10 mentions · first linked 2011-05-18
- A Saudi Arabia Telecom's Surveillance Pitch7 people · 8 mentions · first linked 2013-05-13
- A Crypto Challenge For The Telegram Developers7 people · 7 mentions · first linked 2013-12-20
- SSL And The Future Of Authenticity6 people · 8 mentions · first linked 2012-11-26
What Hacker News says?
This article[0] is largely about DNSSEC and DANE but it might give you some insights why making registrars the sole authorities isn't such a good idea. [0] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
Comment linking /blog/ssl-and-the-future-of-authenticity/
on “Launching in 2015: A Certificate Authority to Encrypt the Entire Web”Submitted The Worst as a story · 770 points
HN discussionHow many people are careful to type "https" every time they visit a website? How many people pay close attention to the lock icon/color of the URL bar? This advice seems to ignore the existence of sslstrip [0] and related attacks, and the numerous countermeasures that have been designed to deal with this problem (e.g. HSTS). [0] http://www.thoughtcrime.org/software/sslstrip/
Comment linking /software/sslstrip/
on “Launching in 2015: A Certificate Authority to Encrypt the Entire Web”Submitted GPG and Me as a story · 588 points
HN discussionhttps://www.schneier.com/crypto-gram/archives/1998/1215.html... http://thoughtcrime.org/blog/telegram-crypto-challenge/
Comment linking /blog/telegram-crypto-challenge/
on “WhatsApp's Signal Protocol integration is now complete”Submitted A Crypto Challenge For The Telegram Developers as a story · 486 points
HN discussion> I still feel there should be better solutions to that problem than changing the port Well, there is port knocking. http://www.thoughtcrime.org/software/knockknock/
Comment linking /software/knockknock/
on “How I spend my first 5 minutes on a server”Submitted A Saudi Arabia Telecom's Surveillance Pitch as a story · 459 points
HN discussionHere's a link to an overview of the service and architecture: http://highscalability.com/blog/2013/8/13/in-memoriam-lavabi... And a critique of the design from Moxie Marlinspike: http://www.thoughtcrime.org/blog/lavabit-critique/ The critique provides details about how relatively easily the server could obtain any information about an account and its contents.
Comment linking /blog/lavabit-critique/
on “Why I was forced to shut down Lavabit”Submitted We Should All Have Something To Hide as a story · 438 points
HN discussion> Additionally can you explain how he got the architecture "wrong"? See Moxie Marlinspike's post from last November: http://www.thoughtcrime.org/blog/lavabit-critique/ You can't entrust a server with encryption / decryption, nor with supplying the tools to do it locally, e.g., via JS downloaded as part of a web interaction. Service providers can be subpoenaed, threatened, infiltrated, bribed, or hacked. Or they can…
Comment linking /blog/lavabit-critique/
on “Why I was forced to shut down Lavabit”Submitted A Critique of Lavabit as a story · 245 points
HN discussionIt seems a little much to blame lavabit for sitting in the USA with its constitutional protections of free speech and privacy, and suggest it should set up in say a offshore banking haven, few of which have constitutions and a couple have dictatorial-like powers. Additionally can you explain how he got the architecture "wrong"? Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit…
Comment linking /blog/lavabit-critique/
on “Why I was forced to shut down Lavabit”Submitted We Should All Have Something to Hide (2013) as a story · 239 points
HN discussionhttp://www.thoughtcrime.org/blog/lavabit-critique/ The whole thing is worth a read but here's the gist "Unlike the design of most secure servers, which are ciphertext in and ciphertext out, this is the inverse: plaintext in and plaintext out. The server stores your password for authentication, uses that same password for an encryption key, and promises not to look at either the incoming plaintext, the password itsel…
Comment linking /blog/lavabit-critique/
on “A Government Error Just Revealed Snowden Was the Target in the Lavabit Case”Submitted The Cryptographic Doom Principle as a story · 142 points
HN discussionThis is hilarious - though I wish they had more of an artificial delay between the hops to keep the suspense. If you're curious how you might implement this without actually needing a whole bunch of different hosts with routes between them, see this tool by Moxie Marlinspike: http://www.thoughtcrime.org/software/fakeroute/ You still need a big block of IP addresses though since you want the reverse DNS lookup for ea…
Comment linking /software/fakeroute/
on “The Star Wars Route: Do a traceroute to 216.81.59.173”Submitted The Cryptographic Doom Principle as a story · 120 points
HN discussionMoxie, I read your "Money Machine"[1] in print and loved it. After becoming aware of your security work and browsing your website, I discovered you are the author. Small world. My partner and I often fall asleep together listening to "Letters of Insurgents". Thank you for that! [1] http://www.thoughtcrime.org/stories/money-machine/
Comment linking /stories/money-machine/
on “The Worst”Submitted SSL And The Future Of Authenticity as a story · 90 points
HN discussionIf it was satire, someone better tell Moxie about it: http://thoughtcrime.org/blog/the-worst/
Comment linking /blog/the-worst/
on “High Frequency Dating”Submitted Career Advice (2013) as a story · 68 points
HN discussionHere is my list of solo developer blogs. Usually they are on topic. This does not include personal blogs I follow that happen to be developers. @mdo (Bootstrop) - http://markdotto.com/ Keith Cirkel - https://www.keithcirkel.co.uk/ Coding – Corbin's Treehouse - https://www.corbinstreehouse.com/blog Aaditya Purani – Ethical Hacker - https://aadityapurani.com/ Ben Balter - http://ben.balter.com/ fulldecent - https://pr…
Comment linking /blog/
on “Ask HN: What are good solo developer blogs that you enjoy reading?”Submitted Career Advice For Young People as a story · 52 points
HN discussionSome will say that it’s necessary to balance privacy against security, and that it’s important to find the right compromise between the two. Even if you believe that, a good negotiator doesn’t begin a conversation with someone whose position is at the exact opposite extreme by leading with concessions. And that’s exactly what we’re dealing with. Not a balance of forces which are looking for the perfect compromise be…
Comment linking /blog/we-should-all-have-something-to-hide/
on “Inside the NSA's War on Internet Security”Submitted GPG and Me as a story · 17 points
HN discussionMan in the middle attacks on Tor are possible. Check out Moxie Marlinspike's 2009 BlackHat DC Presentation on SSL Stripping: http://vimeo.com/50018478 http://www.thoughtcrime.org/software/sslstrip/
Comment linking /software/sslstrip/
on “The New Yorker Strongbox”Submitted We Should All Have Something to Hide as a story · 8 points
HN discussion> A little bit of thinking with my "evil hat" on leads me to believe a similar protocol aware packet inspection/modification tool could easily rewrite webpages on the fly, looking for links to common service login forms and rewrite appropriate links and form actions to be http instead of https... That already exists in the form of sslstrip: http://www.thoughtcrime.org/software/sslstrip/
Comment linking /software/sslstrip/
on “My Email Canary”Submitted The cryptographic doom principle as a story · 5 points
HN discussion
