What's happening in TLS (transport layer security)?
summary
Heartbleed exposes that roughly 80% OpenSSL monoculture makes TLS brittle and incident handling weak; historical attacks like FireSheep and Google Street View show why browsers push for encryption and HTTP/2 over TLS. Short-term defenses in use are HSTS and public key pinning (with backup-key caveats), and emerging fixes include certificate transparency logs. New crypto (ChaCha20-Poly1305) speeds mobile crypto, and TLS 1.3 targets encrypted handshakes, fewer ciphers, and TLS 1.3 aiming 0-RTT or 1-RTT handshakes for performance.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:50Heartbleed
- 4:55Firesheep
- 6:30HTTP II
- 7:50HTTP
- 8:50Certificate Authorities
- 10:25TLS Man in the Middle
- 11:42Strict Transport Security
- 12:31Public Key Pins
- 13:57Certificate Transparency
- 15:10ChaCha 20 Poly1305
- 16:27TLS 13 Working Group
- 17:34Resources
related talks
45mUnlocking The Secrets Of TLS
53mHansel and Gretel do TLS
55mUnlocking The Secrets Of TLS
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
53m25 Years of SSL - Secure(ish) Sockets Layer
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
14mJust the Cryptography You Need to Know for TLS
58m25 Years of SSL - Secure(ish) Sockets Layer