Velocity Conference Santa Clara 2014 Ignite

Security - go do this.

Video at https://www.youtube.com/watch?v=8GMIm_Pcxuw

I have a version with notes, which may or may not be more useful. Email/message me if you want them!

Transcript

1. Security: I Have 5 minutes,
   You Have a Lifetime
   Ben Hughes, Etsy, obviously,
   just look at this slide.
   

   View Slide

2. These are real graphs of *something*
   

   View Slide

3. Mean Time to PasteBin™
   

   View Slide

4. `
   photo by https://secure.flickr.com/photos/asjaboros/
   

   View Slide

5. https://secure.flickr.com/photos/izik/
   SSL*
   *(TLS really)
   

   View Slide

6. https://secure.flickr.com/photos/refractedmoments/
   

   View Slide

7. https://secure.flickr.com/photos/gaby1
   

   View Slide

8. https://isTLSfastyet.com/
   Ummm, yeah, fast enough.
   big shout out to the design of this slide.
   

   View Slide

9. View Slide

10. Password hashing: Just use bcrypt.
    

    View Slide

11. BUT WHAT ABOUT scrypt/
    PBKDF2/SpecialThing?
    

    View Slide

12. Cross Site Request Forgery
    

    View Slide

13. And you were worried HTTPS would slow things down…
    

    View Slide

14. Multi factor
    authentication
    Awesome taken apart SecureID token by https://www.flickr.com/photos/travisgoodspeed
    

    View Slide

15. View Slide

16. Responsible
    disclosure is
    pretty cool!
    

    View Slide

17. The winner takes it all!
    

    View Slide

18. Bounty Hunters
    You may want to consider
    their kind of scum.
    

    View Slide

19. View Slide

20. https://github.com/etsy
    http://codeascraft.com/
    @benjammingh
    ben@etsy.com
    

    View Slide