Website security 101
summary
Demonstration runs free online scanners like checktls.com, securityheaders.io and SSL Labs against conference and news sites and reports concrete failures: no IPv6, no DNSSEC, missing SPF/DKIM for mail, TLS configuration graded F with certificate name mismatch, and weak cipher suites. It cites adoption numbers — STARTTLS rising from under 20% to over 60% after outreach — and recommends deployable defenses: HSTS, HPKP, CSP, HTTP/2, X-Content-Type-Options, X-XSS-Protection and X-Frame-Options to eliminate the exact risks found.
AI-written summary · about
chapters (12)
- 0:00Intro
- 5:35The website
- 11:35Presentation
- 14:27HTTPS
- 19:03Email
- 24:31Restaurant
- 27:21Discovery
- 29:46HSTS
- 30:49HP KP
- 34:43Ukrainian newspapers
- 37:30HTTP
- 38:57Chrome
related talks
59mProactively defending your business
13mA Positive Security Talk
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
59mHTTP Security Headers You Need To Have On Your Web Apps
19mHow Safe Is Your Domain?
38mWhy Do We Need Security Headers?
37mHTTPS Is Better than Ever Before. Now Its Your Turn.