1 / 64

HTTPS in 2015

HTTPS in 2015. Eric Lawrence @ ericlaw. Quick Introductions. Eric Lawrence @ ericlaw. Why?. Bad guys Government snoops Non-neutral networks ( Gogo , corporate) “Value adding providers” Rewards Increased user trust Better search ranking More reliable egress (HTTP2; WebSocket).

adin
Download Presentation

HTTPS in 2015

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. HTTPS in 2015 Eric Lawrence @ericlaw

  2. Quick Introductions Eric Lawrence @ericlaw

  3. Why? • Bad guys • Government snoops • Non-neutral networks (Gogo, corporate) • “Value adding providers” Rewards • Increased user trust • Better search ranking • More reliable egress (HTTP2; WebSocket)

  4. The Stack • Your Client Browser • HTTP • SSL/TLS • TCP • IP

  5. HTTPS Provides… • Authentication • Confidentiality • Integrity

  6. How? • Public Key Infrastructure for certificate chains • Public Key Cryptography for key exchanges • Symmetric Cryptography for data transfers

  7. Certificates

  8. Hash Algorithms • MD5 busted • SHA1 heading that way • SHA256 entering mainstream in 2015

  9. Validating the Certificate • Validate certificate signature • Validate it is within validity period • Validate it chains to trusted root • Validate Subject CN or SubjectAltNamecontains hostname of the target… • Wildcards • Check to see if it was revoked

  10. Extended Validation SSL BankoftheVVest.com phishing site Domain validation and the race to the bottom

  11. Ciphers, Hashes, and MACs oh my…

  12. Initial Handshake

  13. SNI Extension • Break the IPEndpoint->Server mapping • Important to allow HTTPS virtual hosting • Not available on WinXP or Android < v2.3 

  14. Forward Secrecy • If you can record ALL of the traffic… • And you’re using RSA… • And you can ever steal or crack the private key (at any point in the future…  Achieving Forward SecrecyDo not use the RSA key exchange, which does not provide forward secrecy. Instead, look for the string ECDHE or DHE in the cipher suite name. RSA can be used for keyexchangeand authentication; there is nothing wrong with the latter.

  15. Popular Ciphers • Triple-DES • RC4 • AES • ChaCha (new)

  16. Revocation • CRL (Certificate Revocation List) • OCSP (Online Certificate Status Protocol) • Deployed blocklists

  17. Certificate Pinning • Built-into browser • Distributed with security software like Microsoft EMET • New HTTP Public Key Pinning header https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21 • Public-Key-Pins: pin-sha256="GHI..."; pin-sha256="JKL..."; max-age=… report-uri=…;includeSubDomains

  18. Certificate Transparency http://www.certificate-transparency.org/ Google Chrome intends to require Certificate Transparency (CT) for all EV certificates issued after 2014. A SCT “Signed Certificate Timestamp” is added to the certificate.

  19. Performance

  20. https://www.youtube.com/watch?v=0EB7zh_7UE4

  21. Session Resumption http://calendar.perfplanet.com/2014/speeding-up-https-with-session-resumption/

  22. ECC Public Keys ECC certificates offer stronger security and smaller certificates - e.g. a 256-bit ECC key is equivalent to a 3072-bit RSA key. http://arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

  23. Run Latest Versions

  24. I’m in!

  25. Enabling HTTPS for your site will be as easy as installing a small piece of certificate management software on the server: • https://example.com is immediately live. • The Let’s Encrypt management software will: • Automatically prove to the Let’s Encrypt CA that you control the website • Obtain a browser-trusted certificate and set it up on your web server • Keep track of when your certificate is going to expire, and automatically renew it • Help you revoke the certificate if that ever becomes necessary. • No validation emails, no complicated configuration editing, no expired certificates breaking your website. And of course, because Let’s Encrypt provides certificates for free, no need to arrange payment.

  26. WebDev Errors • Critical Mistake #1: Non-HTTPS Login pages (even if submitting to a HTTPS page).

  27. WebDev Errors • Critical Mistake #2: Mixing HTTP Content into a HTTPS page

  28. HSTS

  29. HSTS • Insecure references are upgraded • Certificate errors are fatal Use the HTTPS response header: Strict-Transport-Security: max-age=63072000; includeSubDomains Or get on the browsers’ pre-load list (avoid bootstrapping problem) http://blogs.msdn.com/b/ieinternals/archive/2014/08/18/hsts-strict-transport-security-attacks-mitigations-deployment-https.aspx

  30. Fiddler Visualization If there’s an exclamation point in the column, you’ve done something wrong!

  31. Migration Guide https://t.co/0ORIlnp64YChris Palmer @fugueish • Use STS • Use Secure attribute on cookies • Protocol-relative URLs • Run the QualysSSLLabs Server test

  32. SSLLabs

  33. HTTPS all the Things!

  34. Best Practice • Secure everything. It’s very hard to predict future attack scenarios. • Yes, really.

  35. HTTP Content indicator

  36. HTTP Content indicator

  37. Not Just Browsers…

  38. Hacks

  39. HTTPS Traffic Analysis • Source IP • Destination IP • Server Name (via SNI) • Higher-level protocol (via ALPN) • Client Certificates (if sent before encryption)

  40. Implementation Issues • Truncation • Compression • Clickthrough UI

  41. Implementation Issues • Truncation • Compression • Clickthrough UI

More Related