Are you going to be in Vegas during BlackHat / DEF CON? We're hosting a mixer, sponsored by Observa! We have limited capacity, so please only register if you can actually come. Location details are in the confirmation email. Tickets will be released in batches, so if you get waitlisted, there's a good chance you still get in. Looking forward to seeing you in Vegas!

Ticket Link: https://www.eventbrite.com/e/scwpod-vegas-2024-tickets-946939099337

We talk about CrowdStrike in this episode, but we know we made some mistakes:

• The sys files may be code in addition to data.
• The bug might be bigger than "just" a null pointer exception.

Luckily, none of that is actually relevant to the main issues we discuss.

Show page: https://securitycryptographywhatever.com/2024/07/24/summertime-sadness/

Other Links:

• https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization
• https://dadrian.io/blog/posts/pqc-signatures-2024/
• https://dadrian.io/blog/posts/cto/
• https://www.blackhat.com/us-24/briefings/schedule/
• https://terrapin-attack.com/
• https://www.youtube.com/watch?v=-AqayGm0_pw

More like ClownStrike, amirite?

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian)

We have Mark Dowd on, founder of Aziumuth Security and one of the authors of The Art of Software Security Assessment, to talk about the market for zero day vulnerabilities, and how mitigations affect monetizing offensive security work.

Transcript: https://securitycryptographywhatever.com/2024/06/24/mdowd/

Links:

• https://www.azimuthsecurity.com/
• https://www.vigilantlabs.com/
• https://github.com/mdowd79/presentations/blob/main/bluehat2023-mdowd-final.pdf
• https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Hack-Different-Pwning-IOS-14-With-Generation-Z-Bug-wp.pdf
• https://i.blackhat.com/USA-19/Wednesday/us-19-Shwartz-Selling-0-Days-To-Governments-And-Offensive-Security-Companies.pdf

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian)

iykyk

Transcript: https://securitycryptographywhatever.com/2024/05/25/ekr/

Links:
- https://hovav.net/ucsd/dist/draft-shacham-tls-fasttrack-00.txt
- https://crypto.stanford.edu/~dabo/pubs/papers/fasttrack.pdf
- https://datatracker.ietf.org/doc/html/rfc8446
- SoK: SCT Auditing in Certificate Transparency: https://arxiv.org/pdf/2203.01661
- A hard look at Certificate Transparency, Part I: Transparency Systems: https://educatedguesswork.org/posts/transparency-part-1/
- A hard look at Certificate Transparency: CT in Reality: https://educatedguesswork.org/posts/transparency-part-2/
- E2EE on the web: is the web really that bad? https://emilymstark.com/2024/02/09/e2ee-on-the-web-is-the-web-really-that-bad.html
- Launching Default End-to-End Encryption on Messenger: https://about.fb.com/news/2023/12/default-end-to-end-encryption-on-messenger/
- ekr's newsletter: https://educatedguesswork.org
- Over 25 years of ekr RFCs: https://www.rfc-editor.org/search/rfc_search_detail.php?sortkey=Date&sorting=DESC&page=All&author=rescorla&pubstatus[]=Any&pub_date_type=any

Subscribe to his newsletter at https://educatedguesswork.org/

"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian)