SSL++; Tales of Transport Layer Security at Twitter

•

1 recomendación•1,012 vistas

presentation at BSides San Francisco, Feb 24 2013. corresponding video available @ https://www.brighttalk.com/webcast/7651/69207

Tecnología Educación

SSL++
Tales of Transport-Layer Security at Twitter

@jimio | #BSidesSF

http://twitter.ie
https://twitter.com
http://twitter.com

http://twitter.ie
https://twitter.com
http://twitter.com

http://www.w3.org

http://wtf.ru

http://twitter.uz

<link rel="canonical" href="https://twitter.com/">

< X-WebKit-CSP-Report-Only: default-src https:
data: chrome-extension: 'unsafe-inline'
'unsafe-eval'; report-uri https://twitter.com/
scribes/csp_report; frame-src https://* about:
javascript: chrome-extension:
< X-Content-Security-Policy-Report-Only:
options eval-script inline-script; report-uri
https://twitter.com/scribes/csp_report; allow
https://* data: ; frame-src https://* about:
javascript:

secureheaders
Strict-Transport-Security
Content-Security-Policy
X-XSS-Protection
X-Frame-Options
X-Content-Type-Options

1. OS:
validate revocation, expiration
2. App:
check against local bundle
3. Party on

https://twitter.com/jobs
https://t.co/h4x0r
#jointheﬂock
@jimio

Más contenido relacionado

Destacado

Cisco Trustsec & Security Group Tagging

Cisco Canada

HK VForum F5 apps centric security nov 4, 2016 - final

Juni Yan

F5 Offers Advanced Web Security With BIG-IP v10.1

DSorensenCPR

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

APNIC

The VIPRION® 2400 is a midrange chassis-based hardware platform. Adding to the successful F5® VIPRION product line, the new Application Delivery Controller (ADC) provides significant price/performance advantages for enterprises. In addition, F5's Virtual Clustered Multiprocessing (vCMP™) technology combines virtualization and multi-tenancy capabilities to help customers consolidate and efficiently manage application delivery services. Building on F5’s previously announced Clustered Multiprocessing (CMP™) technology, vCMP enables multiple instances of BIG-IP® software to run on one device.

VIPRION 2400 and vCMP

F5 Networks

CCNA RS_ITN - Chapter 7

Irsandi Hasan

Best Practice TLS for IBM Domino

Jared Roberts

The F5 DDoS Protection Reference Architecture (Technical White Paper)

F5 Networks

CCNA RS_NB - Chapter 5

Irsandi Hasan

Internetworking Overview

scooby_doo

Transport layer security (tls)

Kalpesh Kalekar

Building the Mobile Internet

Klaas Wierenga

F5 study guide

shimera123

Finding a cost-effective solution that allows you to rapidly deliver cloud-based applications securely can be challenging. F5 on AWS offers a variety of solutions and licensing options, so organizations can choose the best fit for their business needs. Join our webinar to learn best practices for controlling access for your cloud-based applications. Watch the F5 and AWS webinar to learn how to strengthen your security using strong access control and application-layer firewall services.

F5 BIG-IP: Secure Application and Data Security Services

Amazon Web Services

Destacado (14)

Cisco Trustsec & Security Group Tagging

HK VForum F5 apps centric security nov 4, 2016 - final

F5 Offers Advanced Web Security With BIG-IP v10.1

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

VIPRION 2400 and vCMP

CCNA RS_ITN - Chapter 7

Best Practice TLS for IBM Domino

The F5 DDoS Protection Reference Architecture (Technical White Paper)

CCNA RS_NB - Chapter 5

Internetworking Overview

Transport layer security (tls)

Building the Mobile Internet

F5 study guide

F5 BIG-IP: Secure Application and Data Security Services

Último

Partners Life - Insurer Innovation Award 2024

The Digital Insurer

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

MINDCTI Revenue Release Quarter One 2024

MIND CTI

🐬 The future of MySQL is Postgres 🐘

RTylerCroy

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

The presentation explores the development and application of artificial intelligence (AI) from its inception to its current status in the modern world. The term "artificial intelligence" was first coined by John McCarthy in 1956 to describe efforts to develop computer programs capable of performing tasks that typically require human intelligence. This concept was first introduced at a conference held at Dartmouth College, where programs demonstrated capabilities such as playing chess, proving theorems, and interpreting texts. In the early stages, Alan Turing contributed to the field by defining intelligence as the ability of a being to respond to certain questions intelligently, proposing what is now known as the Turing Test to evaluate the presence of intelligent behavior in machines. As the decades progressed, AI evolved significantly. The 1980s focused on machine learning, teaching computers to learn from data, leading to the development of models that could improve their performance based on their experiences. The 1990s and 2000s saw further advances in algorithms and computational power, which allowed for more sophisticated data analysis techniques, including data mining. By the 2010s, the proliferation of big data and the refinement of deep learning techniques enabled AI to become mainstream. Notable milestones included the success of Google's AlphaGo and advancements in autonomous vehicles by companies like Tesla and Waymo. A major theme of the presentation is the application of generative AI, which has been used for tasks such as natural language text generation, translation, and question answering. Generative AI uses large datasets to train models that can then produce new, coherent pieces of text or other media. The presentation also discusses the ethical implications and the need for regulation in AI, highlighting issues such as privacy, bias, and the potential for misuse. These concerns have prompted calls for comprehensive regulations to ensure the safe and equitable use of AI technologies. Artificial intelligence has also played a significant role in healthcare, particularly highlighted during the COVID-19 pandemic, where it was used in drug discovery, vaccine development, and analyzing the spread of the virus. The capabilities of AI in healthcare are vast, ranging from medical diagnostics to personalized medicine, demonstrating the technology's potential to revolutionize fields beyond just technical or consumer applications. In conclusion, AI continues to be a rapidly evolving field with significant implications for various aspects of society. The development from theoretical concepts to real-world applications illustrates both the potential benefits and the challenges that come with integrating advanced technologies into everyday life. The ongoing discussion about AI ethics and regulation underscores the importance of managing these technologies responsibly to maximize their their benefits while minimizing potential harms.

Artificial Intelligence: Facts and Myths

Joaquim Jorge

This presentation explores the impact of HTML injection attacks on web applications, detailing how attackers exploit vulnerabilities to inject malicious code into web pages. Learn about the potential consequences of such attacks and discover effective mitigation strategies to protect your web applications from HTML injection vulnerabilities. for more information visit https://bostoninstituteofanalytics.org/category/cyber-security-ethical-hacking/

HTML Injection Attacks: Impact and Mitigation Strategies

Boston Institute of Analytics

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

A Domino Admins Adventures (Engage 2024)

Gabriella Davis

Abhishek Deb(1), Mr Abdul Kalam(2) M. Des (UX) , School of Design, DIT University , Dehradun. This paper explores the future potential of AI-enabled smartphone processors, aiming to investigate the advancements, capabilities, and implications of integrating artificial intelligence (AI) into smartphone technology. The research study goals consist of evaluating the development of AI in mobile phone processors, analyzing the existing state as well as abilities of AI-enabled cpus determining future patterns as well as chances together with reviewing obstacles as well as factors to consider for more growth.

Exploring the Future Potential of AI-Enabled Smartphone Processors

debabhi2

Top 10 Most Downloaded Games on Play Store in 2024

SynarionITSolutions

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Drew Madelung

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

Discord is a free app offering voice, video, and text chat functionalities, primarily catering to the gaming community. It serves as a hub for users to create and join servers tailored to their interests. Discord’s ecosystem comprises servers, each functioning as a distinct online community with its own channels dedicated to specific topics or activities. Users can engage in text-based discussions, voice calls, or video chats within these channels. Understanding Discord Servers Discord servers are virtual spaces where users congregate to interact, share content, and build communities. Servers may revolve around gaming, hobbies, interests, or fandoms, providing a platform for like-minded individuals to connect. Communication Features Discord offers a range of communication tools, including text channels for messaging, voice channels for real-time audio conversations, and video channels for face-to-face interactions. These features facilitate seamless communication and collaboration. What Does NSFW Mean? The acronym NSFW stands for “Not Safe For Work,” indicating content that may be inappropriate for professional or public settings. NSFW Content NSFW content encompasses material that is sexually explicit, violent, or otherwise graphic in nature. It often includes nudity, profanity, or depictions of sensitive topics.

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

UK Journal

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

SSL++; Tales of Transport Layer Security at Twitter

1. SSL++ Tales of Transport-Layer Security at Twitter @jimio | #BSidesSF

2. CRIME

3. BEAST

5. HTTP

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25. 100% Certiﬁed SSL

26.

27. <img src="http://twitter.com"/>

28. secure;

29.

30. sslstrip

31.

32. 301

33. #!

34. #!/jimio twitter.com/

35. #!/jimio twitter.com/

36.

37. DISCLAIMER

38. DISCLAIMER we did this.

39. DISCLAIMER we did this. you can too.

40. Hello!

41. twitter Hello!

42. twitter

43. twitter

44. twitter

45.

46. http://twitter.com

47. https://twitter.com http://twitter.com

48. http://twitter.ie https://twitter.com http://twitter.com

49. http://twitter.ie https://twitter.com http://twitter.com http://www.w3.org http://wtf.ru http://twitter.uz

50. <link rel="canonical" href="https://twitter.com/">

51. %2F

52. /

53.

54.

55. <-HTTPS

56. Hello!

57. twitter.com Hello!

58. HTTP...

59. but wait!!

60.

61.

62. HSTS

63. HSTS

64. HTTP=>HTTPS 300s 0

65. HTTP=>HTTPS 300s 0

66. includeSubdomains

67. include$ubdomains

68. CSP

69. CSP

70. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

71. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

72. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

73. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

74. secureheaders

75. secureheaders Strict-Transport-Security Content-Security-Policy X-XSS-Protection X-Frame-Options X-Content-Type-Options

76. SSL

77.

78.

79.

80. 1. OS: validate revocation, expiration 2. App: check against local bundle 3. Party on

81.

82.

83.

84.

85.