One of the worst problems with HTTPS in 2015 was that it wasn't adopted widely enough. Let's Encrypt helped change this by offering free certificates from an automated, trusted CA. It changed a set up process that would take hours of time and $50-$100 every year to be automatic and free and Let's Encrypt has become the largest CA in the world. I was on the founding team and was privileged to work alongside J. Alex Halderman, Peter Eckersley, Seth Schoen, Eric Rescorla, Josh Aas, and Richard Barnes. I worked on Let's Encrypt from March 2012 through November 2015 with the University of Michigan and as an EFF Technology Fellow from October 2014 to October 2015. I was a co-author on the protocol, ACME, RFC 8555, was the lead maintainer of Certbot and handled many communications while at the University of Michigan and EFF.

Blog Posts: Freedom To Tinker, EFF Blog Post
Videos: DEFCON Talk, My Original Demo Video
Academic Paper: Let’s Encrypt: An Automated Certificate Authority to Encrypt the Entire Web
Select News Articles: Washington Post, CNET

Although OpenSSL is one of the standard libraries for TLS and is used on millions of servers, its documentation leaves much to be desired. The library is so unwieldy that projects in the past have chosen to parse the output of the OpenSSL binary rather than use the underlying API. As part of Zmap, Zakir Durumeric and I demystified the certificate parsing with the OpenSSL API which has enabled our daily scans of the HTTPS certificate ecosystem and, in turn, much of my research. Code

Instrumented dynamic taint analysis to code within the LLVM compiler. Adding the instrumentation within LLVM IR has a few key benefits. It allows the augmentation to be performed on both original source code in any of the languages supported by LLVM, as well as on binaries that are disassembled to the LLVM intermediate representation. The instrumented LLVM IR is also easily optimized by LLVM's existing passes. Presentation

My midsemester attack project for EECS 588. We modified a Linksys WRT54G router to conduct a man-in-the-middle attack against users who connected through it. The router inserts Trojan horses into all executables downloaded over HTTP. Presentation

Browsers use a one-size-fits-all security model that is applied to content of every type rather than tailoring their security to the requirements of the particular website. We built a Firefox extension to implement "e-commerce" and "banking" modes that adapt Firefox's security policies based on the user's browsing activity. Short Presentation

A mechanism designed to allow the privacy and security information of third-party applications to flow from the advanced, knowledgeable users to the novices. Presentation

Implementation of a labeling system for files on a traditional hierarchical file system. The labels can be applied through filters (similar to Gmail's) or manually through a GUI interface. The labels allow for quick search and retrieval of related files. Poster