HTTPS & TLS in 2016: Security practices from the front lines

on YouTube ↗01h 01m

" summary

Covers concrete failures and fixes: exploits like FREAK, BEAST, POODLE and LOGJAM, migration choices (ECDSA vs RSA, 2K vs 4K), and deployment recipes for Apache, Nginx, libcurl and load balancers; demonstrates tools and primitives such as Curve25519 and ChaCha/Poly1305 and surveys BoringSSL LibreSSL LibSodium; reports on a 93 million certificate corpus used in the OpenSSL 1.1 audit, shows millions of CT log entries under Certificate Transparency, and notes HSTS preload list adoption in the tens of thousands.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 0:20Topics
3. 2:17Confidentiality
4. 3:30Authenticity
5. 6:18Integrity
6. 14:56Mozilla Security Blog
7. 18:40With HSTS
8. 31:19HTTP/2
9. 35:45Real-world Apache/Nginx TLS
10. 40:23CBC is a problem
11. 43:38OpenSSL 1.1 Audit

" related talks

• 53m25 Years of SSL - Secure(ish) Sockets LayerScott Helme · NDC Security Oslo 2020
• 53mHansel and Gretel do TLSMarcus Bointon · International PHP Conference Spring 2019
• 44mSSL/TLS for MortalsMaarten Mulders · GOTO Berlin 2018
• 19mWhat's happening in TLS (transport layer security)?Mark Nottingham · Web Directions Code 2014
• 50mSSL/TLS for MortalsMaarten Mulders · Devoxx Belgium 2019
• 40mWebsite security 101Per Thorsheim · QA Fest 2016
• 59mProactively defending your businessJim Manico, Cassio Goldschmidt · AppSec California 2015
• 58m25 Years of SSL - Secure(ish) Sockets LayerScott Helme · NDC TechTown 2020