Juliano Rizzo
Argentine security researcher who, with Thai Duong, turned old cryptographic warnings into working attacks on TLS and web frameworks.
In 2010 the pair showed that ASP.NET leaked information about the padding of encrypted cookies and view state — a padding oracle — which was enough to decrypt them and, at worst, read the server's configuration files. Microsoft shipped an emergency patch outside its regular monthly cycle.
BEAST followed in 2011, exploiting predictable initialisation vectors in TLS 1.0, and CRIME in 2012, which recovered session cookies by measuring how TLS compression shrank requests. Both weaknesses had been known in theory for years; what was new was a demo that got browser vendors moving within the quarter. Both debuted at ekoparty in Buenos Aires, which thereby acquired an unexpected say in how TLS evolved.