HTTPS Is Better than Ever Before. Now Its Your Turn.
summary
Claim: HTTPS now gives confidentiality integrity and authenticity when configured correctly. Actionable specifics: update OS and OpenSSL patch Heartbleed and Logjam avoid export ciphers and RC4 disable RSA key‑exchange and prefer ECDHE (perfect forward secrecy) protect private keys in an HSM run Mozilla’s TLS config generator enable HSTS preload and pin certificates with backup pins and reporting URLs. Evidence: DigiNotar TurkTrust and French CA incidents show CA failures; Apple’s “goto fail” bug shows client bugs; under 2,000 sites use HSTS preload and 30–70% of users click through warnings.
AI-written summary · about
chapters (11)
- 0:00Introduction and goals
- 1:01Fundamentals of HTTPS
- 3:27TLS and crypto basics
- 6:30Certificate authority risks
- 10:29Modern vulnerabilities
- 14:22Common developer mistakes
- 17:35Browser security trends
- 20:42Defensive strategies
- 24:41Advanced implementation
- 31:28Perfect forward secrecy
- 34:06Conclusion and Q&A
related talks
59mProactively defending your business
53mHansel and Gretel do TLS
43mEmerging Web Security Standards
19mWhat's happening in TLS (transport layer security)?
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
58m25 Years of SSL - Secure(ish) Sockets Layer
42mLet's go HTTPS
56mSSL/TLS for Mortals