Your connection is not private - Exploiting insecure certificate validation in TLS clients

No ratings

Presented at Disobey 2023 by

Aapo Oksman

Securing websites and servers with TLS has never been easier. But what about the clients that connect to them? Most TLS connections security rely on the clients ability to validate the server identity correctly. This talk explores the 'most dangerous code in the world'. Lets hack an iPhone, Windows 11 and more while we deep dive into the world of insecure TLS certificate validation.