Everyone who works long enough in the field of cryptography knows about Alice and Bob: They know each other, go their separate ways and – always – are in dire need of private communication. Eve is listening in on every message and Mallory actively tries to trick them into believing her words are genuine. Then the authors of the paper explain their cryptographic protocol that makes Alice and Bob safe again.

There is a lot of news about end-to-end encryption. Every chat app and their neighbours are implementing it, even the big names: the Russians with Telegram, the Americans with Allo, Facetime, Skype, Whatsapp and what not. So that’s good, isn’t it? Yes, end to end encryption is good! It makes sure that your message, your love letter, voip or telephone call can only be read by the one you intend it for and no one else.

Tor is the well known Onion Routing network. It lets people communicate over the internet without revealing their location. Using the Tor network is easy*) if all you need is browsing. Just run Tails or Whonix and browse. The sites can’t figure out where you are. This is good for your privacy, your anonymity. And good for people in countries that censor parts of the rest of the world. Others use Tor to host a hidden server.

As a child I liked to do puzzles. One of these was called “Spot the Differences.” Get all 15 differences correct and you may win a prize. There is an adult version of this game. It’s much more challenging: It is more difficult: Only one picture is shown at a time. Players have to rely on memory to recall the differences; It’s played by millions of people every day, yet many don’t know they are playing; The stakes are higher: If you fail to spot any differences you might lose all the money in your bank account.

Today I’ll be presenting a short talk at the ICANN DNSSEC Workshop in London. It’s about how to get your computer to protect you against phishers. The presentation shows how DNSSEC and DANE form the basis on which this can be built. All it takes is a user agent that does the work for you. The presentation describes how to reach that goal. presentation

Q. What good is a tool that requires complicated rituals such as key signing parties, or fingerprint verification?> A. Instant loss of security, privacy and usability. Q. What good is a tool that uses encryption in a network of plain-text connections? A. Instant suspicion. Q. What good is a tool for circumventing censorship in a country that forbids it? A. Instant confession. Our proposal Eccentric Authentication is a protocol that weaves cryptography into the normal workflow of the net.

There are three types of queries to be made against the Verification service: - submit a certificate; - query a CN; - query any duplicate CN for a given domain. The biggest load on the Certificate verification service are the queries keyed on CN. These queries will be done every time a user comes across a new certificate. On a blog site where every blog and comment is signed with the users’ private key, it means one lookup for each new participant.

With Eccentric Authentication, the goal is to make sure that each client certificate has a globally unique, human memorable name. In other words: there are no two certificates (with different public keys) bearing the same CN. With unique CN’s, people can trust that each signed message must have been signed by the holder of the corresponding private key. This ties human memorable names to public keys. When we make it globally unique, we have squared Zooko’s Triangle.

There is a huge gap between the way the current deployed crypto-tools work and the requirements of the normal end user. End User Trust Model The common user has these requirements: Don’t think, just click. Someone else must protect me. For free. On 1: Users don’t want to be bothered with anything that stands in the way of what they want to do. It won’t work. On 2: Users assume that their computer keeps them safe from all harm.

Last week the 5th BruCON was held in Ghent, Belgium. It’s a small (and friendly) security conference. Their motto is: “Hacking for b33r”. Topics ranged from a workshop on breaking old crypto algorithms to pinpointing GSM locations and how to make the compliance process less headache inducing. Too bad there was no beer brewing workshop this year due to pregnancy of the brewer. I was one of the recipients of a grant to work on an open source security project in their 5by5 program.