HTTPS

And I think in this way specifically, right, the fact that we are using, we've armed dentists and everyday people with, you know, weapons-grade cryptography that is, you know, in a pocket ergonomic format, like this is a device from the future, right? When we all understand that the internet is a dangerous place and you can't just roll up with no credentials and you can't just trust anything and you kind of need strong cryptography just to do basic interactions on the internet.

I mean, that has been true for 20 years with HTTPS, which is a form of cryptography to keep our communication safe.

That's the little lock in your browser, right? There's a reason that's there.

But we also remember there was a time when HTTPS was only ever used on payment pages.

So like the entire internet was essentially plain text.

And then only when you did a credit card transaction did you suddenly see the shield pop up or HTTPS in your browser URL.

And then through the efforts of smart nerds, basically, there was an HTTPS everywhere movement.

We just kind of moved to like, look, everything is going to be on HTTPS from now on, no matter what.

That is, whether two strangers can share a secret message over public channels, such as the Internet, without eavesdroppers having an efficient way to decipher it.

We rely on public key encryption every day for end-to-end encrypted messaging apps, virtual private networks, VPNs, and even the HTTPS protocol you're probably using to read this article.

But all of this is based on the unproven assumption that certain mathematical operations are intrinsically easier to do than to undo.

In fact, this assumption has already been undermined once.

A brief history of public key encryption.

Public key, also called asymmetric, cryptography forms the foundation of secure communication on the Internet.

Whenever you communicate with a website over HTTPS, the website sends you its public key.

Using only that public key, you can verify messages signed by the website and establish a shared secret key for encrypting everything else you send, even if the channel is being eavesdropped on.

Because that's just protecting the information that you're sending.

And by the way, that is still all encrypted through the use of HTTPS, which I know we've talked about that in the past where before, way back in the day, because Scott and I are old, we remember where you could use a tool called SSL strip, which would basically force a captive portal or another system into a plain text essentially so then you could intercept what people were doing on a hotel network uh very easily and today that is much harder to do uh from an attacker perspective

Yeah, and you probably have seen, I've seen this many times.

You go to a hotel and there'd be four or five Wi-Fi hotspots, right? And one of them will say, you know, Hilton guests or whatever.

And by copying that, they had different approaches.

We had four VMs, two doing the HTTPS-based transfer, which was a full transfer, without looking at the SOA record, while the other two, they did an incremental update each time when the route actually changed and the SOA changed, they did an update.

You were testing real systems, real systems code, like the bind code or the NLNet product or not.

This wasn't a synthetic DNS resolver.

for Unbound and for NotResolver.

And Ilias installed Bind and Unbound and NotResolver.

The software that could also fetch the root over HTTPS, which is Unbound and Not, had two versions, one doing DNS

and the other one doing HTTPS.

Right.

HTTPS.

Exactly.

By tunneling through web sockets on that specific port, the attacker's command and control traffic becomes indistinguishable from a user browsing secure websites or watching a video stream.