Overcoming a million reasons not to be HTTPS only
summary
confirm it faces hundreds of customer domains, ~60,000 active documents and roughly a million HTTP references when moving to HTTPS only. Built scanners using regex and HEAD requests to classify links, found ~66,000 documents with mixed content and ~43,000 flagged as active mixed content, then provide one-button fixes for HTTPS/redirect/CDN cases and upload options. Runtime protection uses CSP report-only with Report URI to catch issues before publish. Plan: phase out TLS 1.0/1.1 Aug 6 and enforce HTTPS-only web services Oct 1.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:33Why HTTPS? Encryption
- 8:21Scheme, protocol and ciphers
- 20:02What to do about mixed content...?
- 30:58What could possibly go wrong?
- 37:20Other issues
- 40:21Content-Security-Policy (CSP)
related talks
59mProactively defending your business
40mWebsite security 101
43mEmerging Web Security Standards
44mKeeping the Watchers at Bay
29mBrowser Security in 2017
58m25 Years of SSL - Secure(ish) Sockets Layer
53mI Wanna Deploy You, but My Senses Tell Me to ...
46m2014.10.29 - Security@Scale - Jim O'Leary, Twitter