secure enclave

Brian Warner, author of magic-wormhole, presents the tool at PyCon 2016. He explains how a few secret words let two computers securely transfer files, covering the cryptography (NaCl, SPAKE2) and library use.

WonderWhy surveys complex international borders, including enclaves like Vatican City, San Marino and Lesotho, the enclave-within-enclave town of Baarle, and the India-Bangladesh Cooch Behar region.

Matthew Garrett's linux.conf.au 2012 talk covers EFI and UEFI from the Linux point of view: why the PC BIOS was bad, what EFI changes, the issues it brings, and Secure Boot.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Andreas Antonopoulos answers a question about how to secure your Bitcoin. He covers holding your own keys, backing up the 12 to 24 word seed phrase, and the tradeoffs of custodial accounts, phone wallets and hardware wallets.

Tom Scott visits Cloudflare's San Francisco office to show the wall of lava lamps whose camera feed is used as a source of entropy for random number generation. It is a short explainer on how this helps secure internet encryption.

A 2007 clip in which immigration attorneys describe how they help employers run classified ads designed not to find qualified American applicants, so they can secure green cards for H-1B workers. It is presented as an exposé of the PERM process.

A Curry On talk by Lars Bak, known for V8 and Dart, on building a secure and robust IoT development platform. It discusses language and VM design choices for small devices.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

3Blue1Brown illustrates how enormous the 256-bit search space is, showing how infeasible it is to find a hash or key by guessing and checking.

Moxie Marlinspike speaks at Next Generation Threats 2014 about the challenges of encrypted communication and how Signal addresses them. He also draws on American action movies as narrative for secure communications.

Rob Pike presents Upspin at Gopherfest 2017, an experimental framework for naming and sharing files and data securely and uniformly across a global namespace. It is a project written in Go rather than about Go.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Dan Callahan presents Mozilla Persona, a decentralized, cross-browser authentication system that removes site passwords, at PyCon 2013. He explains how the protocol works and how to add it to a Python site.

A Google I/O 2019 talk explaining the architecture of Linux on Chromebooks (Crostini), a sandboxed Linux development environment built on containers inside a VM, with demos and design rationale.

A short Star Trek TNG clip from 'Brothers' in which Data uses a lockout code with an unusually long, secret-sounding sequence.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

James Mickens's 2015 Harvard colloquium argues that browsers are bloated and insecure because feature races trump clean interface design. He presents a cleaner, more secure browser architecture (Atlantis) with a much smaller API surface.

A Last Week Tonight segment on the US nuclear arsenal and how poorly it is maintained and secured. It covers weapons accidents, outdated launch protocols and security problems.

Part one of Sandia National Labs' first-person documentary on the use control, detonation safety and survivability of US nuclear weapons. It covers nuclear sharing in NATO and how control of use was separated from possession, leading to the always/never problem.

Hamish Coleman describes reverse engineering the keyboard controller in a Thinkpad and reflashing it with custom firmware. He covers how Lenovo secures its firmware, and his ongoing work on the protocol between the BIOS and the vendor flash tool.

Dan Tentler shows a rapid-fire tour of insecure things found on the open internet using Shodan and his own scanning, from unprotected VNC endpoints to industrial controls. The emphasis is on how little security was considered before connecting them.

Ang Cui and Jonathan Voris present firmware modification attacks on networked printers at 28c3, showing how HP printers can be compromised and used as footholds for malware inside sensitive networks.

Tobias Engel's 31C3 talk shows how weaknesses in the SS7 telephone signaling network let companies and attackers locate, track and manipulate phones from anywhere in the world, with precision down to about 50 meters.

Craig Heffner's Black Hat 2013 talk on exploiting network surveillance cameras, covering how insecure their firmware is. It shows how easily such devices can be compromised.

Deviant Ollam's DEF CON 17 talk explains how legally checking a firearm in luggage can be the most secure way to fly with valuable tech. It covers firearm transport rules and luggage locks.

A 2019 BBC News report by John Sudworth, who was given rare access to the secure facilities in Xinjiang where more than a million Muslims are thought to be held. Authorities call them training schools, and the report examines what the visit reveals about the system and conditions inside.

John Oliver's Last Week Tonight segment on US voting machines, covering how they work, their security weaknesses, and how elections could be made more secure.

Highlights of the June 2010 ICANN DNSSEC root Key Signing Ceremony, showing the procedures used to generate and protect the root zone signing key.

A one-minute clip from SSI showing its Quad shredder destroying computer hard drives and electronic scrap.

A short CNN news segment reporting that the FBI is looking at a phone call between Tamerlan Tsarnaev's widow and her husband after his photos were released. It is brief 2013 coverage of the Boston bombing investigation.