[Windows Phone 7 Development and Hacking] cpx86:
I know some of this has already been said in this thread, but maybe I can help clarify it for everyone who's asking when NoDo jailbreaking will be done, or theorizing about how to do it. If anyone finds an error in what I'm about to write, please correct me and I'll update the post.

So how did the original Chevron "jailbreak" work? Without going into detail, it's really very simple:

The basis of all secure communications is the exchange of secure encryption keys. There are two important factors involved in making the keys secure: complexity and authenticity.

Complexity ensures that the keys can't be practically reverse-engineered. In theory, any encryption key can be reverse-engineered, but if it is complex enough, it will take years, sometimes even hundreds or thousands of years, of non-stop computing to do it.

Authenticity means that you can be sure that when you are exchanging encryption keys, you are doing it with the intended party. A crude method of doing this is to simply contact whoever you want to communicate securely with, and give eachother your keys. For obvious reasons, this is usually not very practical though. So another way of ensuring the authenticity is to use a certificate issued by a trusted certificate authority (you may have heard of VeriSign, for example). The idea is simply that if you trust the CA, then you can trust that the certificate actually comes from whoever you are trying to communicate with. The certificate is then used to exchange encryption keys.

What the Chevron hack did was to spoof (i.e fake) the certificate for the Microsoft server WP7 communicates with when syncing apps and what not, and redirect all communications to said Microsoft server back to your local machine. So when the phone tried to communicate with Microsoft, it actually got routed to your machine and was given a spoofed certificate which basically made it think your machine was the Microsoft server.

Why did it work, and how did Microsoft stop it?

The reason it worked is that before NoDo, WP7 did not require that the certificate was issued by a certificate authority. All it required was that the certificate was issued to the correct server. So what Microsoft did was simply to change it so that WP7 requires the certificate to be issued by a CA.

One thing which I think is important to emphasize is that contrary to what some people may think (since it stopped the Chevron hack from working), what Microsoft did is actually a very good thing. In fact, it was very bad from the beginning that this was even possible to do. This is a BIG, capital-H security hole! While it may enable cool stuff like homebrew hacking for us geeks, it also opens the way for a slew of nasty man-in-the-middle attacks. While we may never have heard of anything malicious, I doubt it would have been long before some people began trying to use this to steal data, hijack phones, et cetera.

So where does this leave us?

As I sketched out before, the two key factors in secure communications are complexity and authenticity. The Chevron hack exploited the fact that WP7 did not correctly implement the authenticity part. It now does. Thus, the only option for another man-in-the-middle exploit is to attack it from the complexity angle. Sadly for homebrew applications (but luckily for everyone - including us!) this is completely unfeasible. If there were a way of cracking SSL communications, which is what they and the rest of the world uses, no one would be using SSL. For those who don't know much about this, SSL is the foundation for all secure communications, both on the net and off the net. To give it some perspective, every financial transaction (i.e online banking, shopping, etc) and all military intelligence communications are done using this sort of security. It simply cannot be cracked.

TL; DR:

What I'm basically trying to say is

1) to any would-be hackers: that the man-in-the-middle angle is completely dead. It's pointless to even try. Perhaps there's some flaw in the WP7 to Zune communications, but from what people have been saying already in this thread, it doesn't seem like it. I can't see how this angle could yield anything fruitful.

2) to impatient homebrew fans: that the Chevron hack was pretty much a lucky streak due to a horrible security flaw in WP7. It shouldn't even have been possible to begin with. Any new jailbreak would have to exploit something completely different, probably a third-party flaw (Adobe Reader maybe? :D). After all, say what you will about Microsoft, but they ARE actually pretty good with security. Right now, I think our best bet for homebrewing is to harass Microsoft about providing an official way of unlocking the platform for homebrew. I think they do care about what their users want; they just have so many of them it's hard to get your voice heard. And also, providing a secure platform is probably their main concern, given their previous track record with Windows and Internet Explorer. But if we complain loud enough, maybe they'll push a few more resources to finding a working solution.

I've been going on for waaay too long already. If you think I'm being redundant, stupid, naïve, or that this whole post was useless, well, so be it :) Just my 2c about this whole issue.