How TLS Can Get You Hacked — When Encryption Becomes Trust
summary
Service mesh Istio, Envoy, Kubernetes service accounts issues cause identity abuse, not crypto failures: mTLS proves who a caller says it is, but authorization and lifecycle don’t follow. A live demo shows an orphaned service account (three in the home lab) where a rogue pod replays the front-end identity, bypasses an auth policy and gets 200 to payments while a stranger without the identity gets 403. Short cert lifetimes, no offboarding, and missing admission controls create scale problems cited with Vercel April 19, 2026 and the 71%/91% statistics.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:10Home lab discovery and service mesh identity risks
- 6:07Service mesh as identity provider
- 10:00Live demo of identity misuse
- 14:38Real-world consequences and NHI risks
- 18:11Why TLS alone doesn’t prevent hacks
- 20:00Case study: Versel breach analysis
- 21:45Scale of identity breach problem
- 23:30Mitigation strategies for mesh identities
- 26:06Kubernetes limitations and future solutions
- 28:13Q&A session
related talks
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
32mIstio: Sailing to a Secure Services Mesh
25mIdentity Theft Is Not a Joke, Jim! How Istio Ambient Mesh Safeguards Our Pod...
31mPractical TLS Advice for Large Infrastructure
19mKeynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri...
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
28mService Identity - The Key to Zero Trust with Service Mesh- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars