SSL++; Tales of Transport Layer Security at Twitter

•

1 like•1,012 views

presentation at BSides San Francisco, Feb 24 2013. corresponding video available @ https://www.brighttalk.com/webcast/7651/69207

Technology Education

SSL++
Tales of Transport-Layer Security at Twitter

@jimio | #BSidesSF

http://twitter.ie
https://twitter.com
http://twitter.com

http://twitter.ie
https://twitter.com
http://twitter.com

http://www.w3.org

http://wtf.ru

http://twitter.uz

<link rel="canonical" href="https://twitter.com/">

< X-WebKit-CSP-Report-Only: default-src https:
data: chrome-extension: 'unsafe-inline'
'unsafe-eval'; report-uri https://twitter.com/
scribes/csp_report; frame-src https://* about:
javascript: chrome-extension:
< X-Content-Security-Policy-Report-Only:
options eval-script inline-script; report-uri
https://twitter.com/scribes/csp_report; allow
https://* data: ; frame-src https://* about:
javascript:

secureheaders
Strict-Transport-Security
Content-Security-Policy
X-XSS-Protection
X-Frame-Options
X-Content-Type-Options

1. OS:
validate revocation, expiration
2. App:
check against local bundle
3. Party on

https://twitter.com/jobs
https://t.co/h4x0r
#jointheﬂock
@jimio

Viewers also liked

Cisco Trustsec & Security Group Tagging

Cisco Canada

HK VForum F5 apps centric security nov 4, 2016 - final

Juni Yan

F5 Offers Advanced Web Security With BIG-IP v10.1

DSorensenCPR

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

APNIC

The VIPRION® 2400 is a midrange chassis-based hardware platform. Adding to the successful F5® VIPRION product line, the new Application Delivery Controller (ADC) provides significant price/performance advantages for enterprises. In addition, F5's Virtual Clustered Multiprocessing (vCMP™) technology combines virtualization and multi-tenancy capabilities to help customers consolidate and efficiently manage application delivery services. Building on F5’s previously announced Clustered Multiprocessing (CMP™) technology, vCMP enables multiple instances of BIG-IP® software to run on one device.

VIPRION 2400 and vCMP

F5 Networks

CCNA RS_ITN - Chapter 7

Irsandi Hasan

Best Practice TLS for IBM Domino

Jared Roberts

The F5 DDoS Protection Reference Architecture (Technical White Paper)

F5 Networks

CCNA RS_NB - Chapter 5

Irsandi Hasan

Internetworking Overview

scooby_doo

Transport layer security (tls)

Kalpesh Kalekar

Building the Mobile Internet

Klaas Wierenga

F5 study guide

shimera123

Finding a cost-effective solution that allows you to rapidly deliver cloud-based applications securely can be challenging. F5 on AWS offers a variety of solutions and licensing options, so organizations can choose the best fit for their business needs. Join our webinar to learn best practices for controlling access for your cloud-based applications. Watch the F5 and AWS webinar to learn how to strengthen your security using strong access control and application-layer firewall services.

F5 BIG-IP: Secure Application and Data Security Services

Amazon Web Services

Viewers also liked (14)

Cisco Trustsec & Security Group Tagging

HK VForum F5 apps centric security nov 4, 2016 - final

F5 Offers Advanced Web Security With BIG-IP v10.1

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

VIPRION 2400 and vCMP

CCNA RS_ITN - Chapter 7

Best Practice TLS for IBM Domino

The F5 DDoS Protection Reference Architecture (Technical White Paper)

CCNA RS_NB - Chapter 5

Internetworking Overview

Transport layer security (tls)

Building the Mobile Internet

F5 study guide

F5 BIG-IP: Secure Application and Data Security Services

Recently uploaded

Vector Search @ sw2con for slideshare.pptx

jbellis

Working together SRE & Platform Engineering

Marcus Vechiato

AI mind or machine power point presentation

yogeshlabana357357

Using IESVE for Room Loads Analysis - UK & Ireland

IES VE

At Skynet Technologies, our team of accessibility experts performs automated, semi-automated, and manual audits of websites and web applications as per WCAG 2.2 level AA, ADA, and section 508. Based on evaluations of the accessibility compliance level of the website’s UI, design, source code, navigation, interactive elements, and overall usability, we will provide a digital accessibility evaluation report with in-depth details of potential accessibility barriers and remediation recommendations. Get a manual website WCAG audit (2.0, 2.1, 2.2 level AA) for a small website: 10 pages: $2,500 within 7 business days 30 pages: $7,500 within 14 business days 50 pages: $12,500 within 28 business days For medium websites: 100 pages: $25,000 within 6 weeks For larger websites or audits of all pages, please reach out hello@skynettechnologies.com.

Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...

Skynet Technologies

Where to Learn More About FDO _ Richard at FIDO Alliance.pdf

FIDO Alliance

Webinar Recording: https://www.panagenda.com/webinars/alles-neu-macht-der-mai-wir-durchleuchten-den-verbesserten-notes-eigenschaftendialog/ Haben Sie sich schon einmal über den zu kleinen Eigenschaftendialog in Notes geärgert? Mussten Sie einen Agenten oder eine Aktion erstellen, um schnell mal ein Feld zu ändern? Haben Sie jedes mal endlos nach dem zu vergleichenden Feld gesucht, nachdem Sie ein neues Dokument ausgewählt haben? Wollten Sie das verdammte Ding einfach nur größer machen? Zum Glück gibt es dafür eine Lösung – und sie ist wahrscheinlich bereits installiert! Mit dem kostenlosen panagenda Document Properties (Pro) erhalten Sie den Eigenschaftendialog, den Sie schon immer haben wollten. Größer, anpassbar, und im Volltext durchsuchbar. Sehen Sie mehrere Dokumente gleichzeitig oder vergleichen Sie mit einem Diff-Viewer. Ändern Sie beliebige Felder und haben Sie endlich eine einfache Möglichkeit, Profildokumente für alle Benutzer zu verwalten. Entdecken Sie mit HCL Ambassador Marc Thomas, wie Document Properties Ihre Arbeit vereinfachen und Sie bei der täglichen Verwendung von Domino-Anwendungen unterstützen kann – im Client oder im Designer. Sie werden es nicht bereuen! Für Sie in diesem Webinar - Was Document Properties ist, welche Editionen es gibt und wo es in Notes und Domino Designer zu finden ist - Wie Sie nach einem beliebigen Feld suchen und es bearbeiten, Dokumente vergleichen oder alle Daten per CSV exportieren können - Suchen, Bearbeiten und auch Löschen von Profildokumenten - Welche Konfigurationseinstellungen verfügbar sind, um Funktionen anzupassen - Wie Ihre Endbenutzer davon profitieren - Sehen Sie alles in einer Live-Demo

Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...

panagenda

Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside

Stefan Dietze

Hyatt driving innovation and exceptional customer experiences with FIDO passw...

FIDO Alliance

WebRTC and SIP not just audio and video @ OpenSIPS 2024

Lorenzo Miniero

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

FIDO Alliance

Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...

ScyllaDB

Overview of Hyperledger Foundation

Hyperleger Tokyo Meetup

Ruby has a lot of standard libraries from Ruby 1.8. I promote them democratically with GitHub today via default and bundled gems. So, I'm working to extract them for Ruby 3.4 continuously and future versions. It's long journey for me. After that, some versions may suddenly happen LoadError at require when running bundle exec or bin/rails, for example matrix or net-smtp. We need to learn what's difference default/bundled gems with standard libraries. In this presentation, I will introduce what's the difficult to extract bundled gems from default gems and the details of the functionality that Ruby's require and bundle exec with default/bundled gems. You can learn how handle your issue about standard libraries.

Long journey of Ruby Standard library at RubyKaigi 2024

Hiroshi SHIBATA

Introduction to FIDO Authentication and Passkeys.pptx

FIDO Alliance

Introduction To Iamnobody89757 the vast expanse of the online realm, where anonymity and individuality intertwine, a phenomenon has emerged that captivates the collective curiosity – Iamnobody89757. This enigmatic entity, once a mere username, has transcended its humble origins to become a symbol of the intricate dance between privacy and expression in the digital age. Through this exploration, we delve into the origins, evolution, and far-reaching implications of this intriguing moniker, shedding light on the profound questions it raises about our digital selves. The Origins of iamnobody89757 The origins of iamnobody89757 are shrouded in the virtual mists of the wide internet. The term gained popularity on a niche discussion group that examined the most puzzling puzzles on the internet. In this instance, iamnobody89757 surfaced as a mysterious character who captivated other users with a conversation that was both mysterious and perceptive. These initial interactions were nuanced, filled with veiled references and subtle hints that painted a picture of someone—or something—with an intricate understanding of the digital domain’s darker corners. Although initially dismissed by many as just another anonymous user, the accuracy of certain predictions shared by iamnobody89757 soon captured the collective imagination. The iamnobody89757 enigma began with this shift from an unnoticed commenter to a fascinating subject, laying the groundwork for a growing tale that would weave its way through the fabric of online communities. The Birth of a Digital Persona Tracing the Roots The inception of Iamnobody89757 can be traced back to the early days of online forums and chat rooms, where users sought a delicate balance between anonymity and connectivity. In a world where personal information was a coveted commodity, this seemingly random assemblage of words and numbers became a shield, protecting the user’s identity while allowing them to engage in discourse without fear of judgment or repercussions.

“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf

Muhammad Subhan

Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...

ScyllaDB

The Metaverse: Are We There Yet?

Mark Billinghurst

Portal Kombat : extension du réseau de propagande russe

中央社

Design Guidelines for Passkeys 2024.pptx

FIDO Alliance

Recently uploaded (20)

Vector Search @ sw2con for slideshare.pptx

Working together SRE & Platform Engineering

AI mind or machine power point presentation

Using IESVE for Room Loads Analysis - UK & Ireland

Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...

Where to Learn More About FDO _ Richard at FIDO Alliance.pdf

Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...

Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside

Hyatt driving innovation and exceptional customer experiences with FIDO passw...

WebRTC and SIP not just audio and video @ OpenSIPS 2024

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

Event-Driven Architecture Masterclass: Integrating Distributed Data Stores Ac...

Overview of Hyperledger Foundation

Long journey of Ruby Standard library at RubyKaigi 2024

Introduction to FIDO Authentication and Passkeys.pptx

“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf

Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...

The Metaverse: Are We There Yet?

Portal Kombat : extension du réseau de propagande russe

Design Guidelines for Passkeys 2024.pptx

SSL++; Tales of Transport Layer Security at Twitter

1. SSL++ Tales of Transport-Layer Security at Twitter @jimio | #BSidesSF

2. CRIME

3. BEAST

5. HTTP

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25. 100% Certiﬁed SSL

26.

27. <img src="http://twitter.com"/>

28. secure;

29.

30. sslstrip

31.

32. 301

33. #!

34. #!/jimio twitter.com/

35. #!/jimio twitter.com/

36.

37. DISCLAIMER

38. DISCLAIMER we did this.

39. DISCLAIMER we did this. you can too.

40. Hello!

41. twitter Hello!

42. twitter

43. twitter

44. twitter

45.

46. http://twitter.com

47. https://twitter.com http://twitter.com

48. http://twitter.ie https://twitter.com http://twitter.com

49. http://twitter.ie https://twitter.com http://twitter.com http://www.w3.org http://wtf.ru http://twitter.uz

50. <link rel="canonical" href="https://twitter.com/">

51. %2F

52. /

53.

54.

55. <-HTTPS

56. Hello!

57. twitter.com Hello!

58. HTTP...

59. but wait!!

60.

61.

62. HSTS

63. HSTS

64. HTTP=>HTTPS 300s 0

65. HTTP=>HTTPS 300s 0

66. includeSubdomains

67. include$ubdomains

68. CSP

69. CSP

70. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

71. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

72. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

73. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

74. secureheaders

75. secureheaders Strict-Transport-Security Content-Security-Policy X-XSS-Protection X-Frame-Options X-Content-Type-Options

76. SSL

77.

78.

79.

80. 1. OS: validate revocation, expiration 2. App: check against local bundle 3. Party on

81.

82.

83.

84.

85.