Proactively defending your business
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 11:30· Annenberg Community Beach House: Track 1, 415 Pacific Coast Hwy·
summary
Describes concrete failures and fixes: real incidents (Heartbleed, GoToFail, TurkTrust and the French CA), measurable user behavior (30–70% click through warnings), and hard configuration fixes: use SSL Labs and Mozilla server-side guides, enable HSTS preload, implement certificate pinning for mobile, enable OCSP stapling and ephemeral (PFS) ciphers. Calls out algorithms to phase out (SHA-1, RC4, RSA key exchange) and notes rough adoption numbers (≈1,200 sites preloaded HSTS) and practical deployment pitfalls.
AI-written summary · about
chapters (10)
- 0:00TLS encryption challenges
- 3:56SSL TLS HTTPS basics
- 8:49HTTPS everywhere
- 13:04TLS mistakes in architectures
- 21:50Strict Transport Security benefits
- 26:31Certificate pinning to prevent fraud
- 34:59Perfect forward secrecy
- 41:58Deprecating weak algorithms
- 45:28Certificate revocation failures
- 53:18Call to action
related talks
40mWebsite security 101
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
53mHansel and Gretel do TLS
13mA Positive Security Talk
41mSecurity: The world is broken and you are guilty
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
31m"I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS
51mWeb Platform: The Secure Parts