SSL++; Tales of Transport Layer Security at Twitter

•

1 like•1,012 views

presentation at BSides San Francisco, Feb 24 2013. corresponding video available @ https://www.brighttalk.com/webcast/7651/69207

Technology Education

SSL++
Tales of Transport-Layer Security at Twitter

@jimio | #BSidesSF

http://twitter.ie
https://twitter.com
http://twitter.com

http://twitter.ie
https://twitter.com
http://twitter.com

http://www.w3.org

http://wtf.ru

http://twitter.uz

<link rel="canonical" href="https://twitter.com/">

< X-WebKit-CSP-Report-Only: default-src https:
data: chrome-extension: 'unsafe-inline'
'unsafe-eval'; report-uri https://twitter.com/
scribes/csp_report; frame-src https://* about:
javascript: chrome-extension:
< X-Content-Security-Policy-Report-Only:
options eval-script inline-script; report-uri
https://twitter.com/scribes/csp_report; allow
https://* data: ; frame-src https://* about:
javascript:

secureheaders
Strict-Transport-Security
Content-Security-Policy
X-XSS-Protection
X-Frame-Options
X-Content-Type-Options

1. OS:
validate revocation, expiration
2. App:
check against local bundle
3. Party on

https://twitter.com/jobs
https://t.co/h4x0r
#jointheﬂock
@jimio

Viewers also liked

Cisco Trustsec & Security Group TaggingCisco Canada

HK VForum F5 apps centric security nov 4, 2016 - finalJuni Yan

F5 Offers Advanced Web Security With BIG-IP v10.1DSorensenCPR

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...APNIC

VIPRION 2400 and vCMPF5 Networks

CCNA RS_ITN - Chapter 7Irsandi Hasan

Best Practice TLS for IBM DominoJared Roberts

The F5 DDoS Protection Reference Architecture (Technical White Paper)F5 Networks

CCNA RS_NB - Chapter 5Irsandi Hasan

Internetworking Overviewscooby_doo

Transport layer security (tls)Kalpesh Kalekar

Building the Mobile InternetKlaas Wierenga

F5 study guideshimera123

F5 BIG-IP: Secure Application and Data Security ServicesAmazon Web Services

Viewers also liked (14)

Cisco Trustsec & Security Group Tagging

HK VForum F5 apps centric security nov 4, 2016 - final

F5 Offers Advanced Web Security With BIG-IP v10.1

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

VIPRION 2400 and vCMP

CCNA RS_ITN - Chapter 7

Best Practice TLS for IBM Domino

The F5 DDoS Protection Reference Architecture (Technical White Paper)

CCNA RS_NB - Chapter 5

Internetworking Overview

Transport layer security (tls)

Building the Mobile Internet

F5 study guide

F5 BIG-IP: Secure Application and Data Security Services

Recently uploaded

Designing for Hardware Accessibility at ComcastUXDXConf

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...CzechDreamin

10 Differences between Sales Cloud and CPQ, Blanka DoktorováCzechDreamin

PLAI - Acceleration Program for Generative A.I. StartupsStefano

Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdfFIDO Alliance

THE BEST IPTV in GERMANY for 2024: IPTVreelreely ones

IoT Analytics Company Presentation May 2024IoTAnalytics

UiPath Test Automation using UiPath Test Suite series, part 1DianaGray10

Powerful Start- the Key to Project Success, Barbara LaskowskaCzechDreamin

Free and Effective: Making Flows Publicly Accessible, Yumi IbrahimzadeCzechDreamin

ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...FIDO Alliance

The UX of Automation by AJ King, Senior UX Researcher, OcadoUXDXConf

AI revolution and Salesforce, Jiří KarpíšekCzechDreamin

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...CzechDreamin

How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdfFIDO Alliance

Agentic RAG What it is its types applications and implementation.pdfChristopherTHyatt

Optimizing NoSQL Performance Through ObservabilityScyllaDB

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo DiehlPeter Udo Diehl

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdfFIDO Alliance

Salesforce Adoption – Metrics, Methods, and Motivation, Antone KomCzechDreamin

Recently uploaded (20)

Designing for Hardware Accessibility at Comcast

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

10 Differences between Sales Cloud and CPQ, Blanka Doktorová

PLAI - Acceleration Program for Generative A.I. Startups

Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf

THE BEST IPTV in GERMANY for 2024: IPTVreel

IoT Analytics Company Presentation May 2024

UiPath Test Automation using UiPath Test Suite series, part 1

Powerful Start- the Key to Project Success, Barbara Laskowska

Free and Effective: Making Flows Publicly Accessible, Yumi Ibrahimzade

ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...

The UX of Automation by AJ King, Senior UX Researcher, Ocado

AI revolution and Salesforce, Jiří Karpíšek

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf

Agentic RAG What it is its types applications and implementation.pdf

Optimizing NoSQL Performance Through Observability

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Salesforce Adoption – Metrics, Methods, and Motivation, Antone Kom

SSL++; Tales of Transport Layer Security at Twitter

1. SSL++ Tales of Transport-Layer Security at Twitter @jimio | #BSidesSF

2. CRIME

3. BEAST

5. HTTP

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23.

24.

25. 100% Certiﬁed SSL

26.

27. <img src="http://twitter.com"/>

28. secure;

29.

30. sslstrip

31.

32. 301

33. #!

34. #!/jimio twitter.com/

35. #!/jimio twitter.com/

36.

37. DISCLAIMER

38. DISCLAIMER we did this.

39. DISCLAIMER we did this. you can too.

40. Hello!

41. twitter Hello!

42. twitter

43. twitter

44. twitter

45.

46. http://twitter.com

47. https://twitter.com http://twitter.com

48. http://twitter.ie https://twitter.com http://twitter.com

49. http://twitter.ie https://twitter.com http://twitter.com http://www.w3.org http://wtf.ru http://twitter.uz

50. <link rel="canonical" href="https://twitter.com/">

51. %2F

52. /

53.

54.

55. <-HTTPS

56. Hello!

57. twitter.com Hello!

58. HTTP...

59. but wait!!

60.

61.

62. HSTS

63. HSTS

64. HTTP=>HTTPS 300s 0

65. HTTP=>HTTPS 300s 0

66. includeSubdomains

67. include$ubdomains

68. CSP

69. CSP

70. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

71. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

72. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

73. < X-WebKit-CSP-Report-Only: default-src https: data: chrome-extension: 'unsafe-inline' 'unsafe-eval'; report-uri https://twitter.com/ scribes/csp_report; frame-src https://* about: javascript: chrome-extension: < X-Content-Security-Policy-Report-Only: options eval-script inline-script; report-uri https://twitter.com/scribes/csp_report; allow https://* data: ; frame-src https://* about: javascript:

74. secureheaders

75. secureheaders Strict-Transport-Security Content-Security-Policy X-XSS-Protection X-Frame-Options X-Content-Type-Options

76. SSL

77.

78.

79.

80. 1. OS: validate revocation, expiration 2. App: check against local bundle 3. Party on

81.

82.

83.

84.

85.