Upgrade to Pro — share decks privately, control downloads, hide ads and more …

HTTPS and You

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Tim Nash Tim Nash
January 01, 2017
Programming
0
1k

HTTPS and You

Brief Lightning talk on TLS

Avatar for Tim Nash

Tim Nash

January 01, 2017
Tweet

More Decks by Tim Nash

See All by Tim Nash
Testing Fortifications - WordCamp Brighton
Avatar for Tim Nash timnashcouk
0
470
Come to the dark side, they have cookies
Avatar for Tim Nash timnashcouk
0
1.3k
Come to the dark side
Avatar for Tim Nash timnashcouk
0
68
Practical WordPress Security 2018
Avatar for Tim Nash timnashcouk
0
410
Practical WordPress Security
Avatar for Tim Nash timnashcouk
0
1.7k
Baking Security into your workflow - Early
Avatar for Tim Nash timnashcouk
0
990
Security is Everyone responsibility
Avatar for Tim Nash timnashcouk
0
1.1k

Other Decks in Programming

See All in Programming
AIエージェントのキホンから学ぶ「エージェンティックコーディング」実践入門
Avatar for Masahiro Nishimi masahiro_nishimi
5
400
React 19でつくる「気持ちいいUI」- 楽観的UIのすすめ
Avatar for Hiroshi Morishige himorishige
11
7.3k
15年続くIoTサービスの SREエンジニアが挑む 分散トレーシング導入
Avatar for Melonps melonps
2
190
HTTPプロトコル正しく理解していますか？ 〜かわいい猫と共に学ぼう。ฅ^•ω•^ฅ ﾆｬ〜
Avatar for ♛Heitor Hirose hekuchan
2
680
組織で育むオブザーバビリティ
Avatar for ryotaro kobayashi ryota_hnk
0
170
今から始めるClaude Code超入門
Avatar for 448jp | OKI Yoshiya 448jp
8
8.6k
なるべく楽してバックエンドに型をつけたい！(楽とは言ってない)
Avatar for HIBIKI CUBE hibiki_cube
0
140
MDN Web Docs に日本語翻訳でコントリビュート
Avatar for uutan1108 ohmori_yusuke
0
650
AI時代の認知負荷との向き合い方
Avatar for OptFit Corp. optfit
0
150
なぜSQLはAIぽく見えるのか/why does SQL look AI like
Avatar for florets1 florets1
0
450
それ、本当に安全？ ファイルアップロードで見落としがちなセキュリティリスクと対策
Avatar for ikechi penpeen
7
3.8k
Smart Handoff/Pickup ガイド - Claude Code セッション管理
Avatar for rasshii yukiigarashi
0
130

Featured

See All Featured
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
269
14k
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
31
9.9k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
Avatar for Joe Casabona jcasabona
34
2.6k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
49
9.9k
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
240
Music & Morning Musume
Avatar for Bryan Veloso bryan
47
7.1k
Measuring & Analyzing Core Web Vitals
Avatar for Philip Tellis bluesmoon
9
750
Sam Torres - BigQuery for SEOs
Avatar for Tech SEO Connect techseoconnect
PRO
0
180
Introduction to Domain-Driven Design and Collaborative software design
Avatar for Kenny Baas-Schwegler baasie
1
580
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
1
300
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
239
140k

Transcript

  1. HTTPS:// and you… Tim Nash [UK] https://timnash.co.uk

  2. Tim Nash - WordPress Platform Lead & Developer Advocate at

  3. HTTPS

  4. HTTPS (HTTP over SSL)

  5. SSL (Secure Socket Layer)

  6. It’s all a LIE!!!!!

  7. HTTP over TLS1.2

  8. HTTPS (HTTP (secure)Encrypted)

  9. None

  10. Browser Server Request Packet Response Packet

  11. Browser Server Request Packet Response Packet Client ‘Hello’ Server ‘Hello’

    Cryptographic information Server Certificate Client Key Exchange Send’s Key info signed with servers key Sends Client Certificate Client ‘finished’ Server ‘finished’
  12. None

  13. Pitfalls

  14. Force everything…

  15. search replace http:// https://

  16. Better still 301 all HTTP requests as well

  17. Mixed Content

  18. None

  19. If it loads over HTTP it needs to load over

    HTTPS

  20. Third Party Scripts: Google Analytics, Forms

  21. DEVELOPERS! Don’t hard code URLs

  22. Certificate issues aka Red Screen of death

  23. https://www.ssllabs.com/ssltest/

  24. HTTP/2

  25. Browser Server Requests Packets Response Packets Client ‘Hello’ Server ‘Hello’

    Client Key Exchange Client ‘finished’ Server ‘finished’

  26. Tim Nash timnash.co.uk @tnash 34SP.com [email protected]