'90s: Internet native / BBS addict
2013: First InfoSec con: SAINTCON
2015: HTTPS advocate: SecureUtah.org
Always: The Ethos of Tron
Background & Disclaimers
The Ugly: HTTP abuses
The Bad: HTTPS objections
The Good: HTTPS justification
The Future: Utah
Data Integrity In-transit Privacy Server Identity
Metadata collection
DNS request
You’re from 2006 and you love Upside-Down-Ternet
You are an ISP and want to sell out, annoy, and/or track customers as they move across the web
You are an ISP and want to sell out, annoy, and/or track customers as they move across the web
2015: Verizon, AT&T, Vodaphone and others inject tracking IDs into all mobile browsing by their customers [1, 2, 3, 4]
You are an ISP and want to sell out, annoy, and/or track customers as they move across the web
You are SIGINT and you want an easy way to inject code or track individuals
You are a frumpy government and you want to block only some pages of a website
You engage in BGP attacks for fun, profit, or malice
You retain the web traffic you carry... just in case
Mandatory / regulatory traffic inspection
Encryption decreases server performance
TLS requires a dedicated IP address
Excuse:
Rebuttal:
Excuse:
Rebuttal:
Certificates cost money
Excuse:
Rebuttal:
Can't serve lucrative relevant useful ads
Excuse:
Rebuttal:
Configuration and management are too hard
Excuse:
Rebuttal:
Configuration and management are too hard
Excuse:
Rebuttal:
Mozilla provides an extensive guide
Configuration and management are too hard
Excuse:
Rebuttal:
HTTPS errors produce confusing warnings
Excuse:
Excuse:
Rebuttal:
HTTPS errors produce confusing warnings
Chrome '15: Simplifying the Page Security Icon
Excuse:
Rebuttal:
HTTPS errors produce confusing warnings
Chrome '16: Rethinking Connection Security Indicators
Excuse:
Rebuttal:
HTTPS errors produce confusing warnings
View your browser's warnings:
Excuse:
Rebuttal:
HTTPS errors produce confusing warnings
Seek professional help and/or change jobs
Indifference
Excuse:
Rebuttal:
The whole principle is wrong; it's like demanding that grown men live on skim milk because the baby can't eat steak. - Robert A. Heinlein
The Net interprets censorship as damage and routes around it. - John Gilmore
Censorship reflects a society's lack of confidence in itself. It is a hallmark of an authoritarian regime. - Potter Stewart
Censorship sucks
Reduce unsanctioned tracking
Matthew Green comments on AT&T + NSA collaboration:
The network is hostile
IETF RFC 1122: In general, it is best to assume that the network is filled with malevolent entities that will send in packets designed to have the worst possible effect.
Tor nodes should be assumed to be dangerous
The network is hostile
Alec Muffet asks: Do you love your users?
Firefox & Chrome are moving away from HTTP
Firefox & Chrome are moving away from HTTP
HSTS helps force HTTPS connections
You provide sensitive information
AIDS.gov leaked identifying information of visitors over HTTP
You provide sensitive information
You provide sensitive information
You collect sensitive information
You collect sensitive information
Every Step You Fake: A Comparative Analysis of Fitness Tracker Privacy and Security
Everyone is doing it
Internet & web standards bodies
Everyone is doing it
Major websites switch to HTTPS
Everyone is doing it
News outlets
OMB creates HTTPS-Only Standard
Tony Scott, Federal CIO, issues mandate for all Federal websites:
Full Memorandum [PDF]
OMB creates HTTPS-Only Standard
Tony Scott, Federal CIO, issues mandate for all Federal websites:
Full Memorandum [PDF]
...Empower USA's TLAs? #patrioticbackfire
Stewart A. Baker, former NSA general counsel,
from the Risky Business podcast #412, starting at 51:25
At lot of the reaction to Snowden was not wanting the U.S. in their communications. But the first thing that Silicon Valley did was say 'we need more HTTPS, more TLS.' And, ironically, that probably empowered U.S. intelligence, vis-a-vis the intelligence agencies and the law enforcement agencies of the rest of the world, more than any other technical development since international cables, because it meant that people who'd been getting communications between two Brazillians just by tapping their lines couldn't do it anymore because the communications were going straight back to Hotmail encrypted and the only way to get it was to get it at the server and that meant going hat-in-hand to the U.S. Government and saying 'could you help us investigate this crime.'
Server-side implementation is solvable for a growing majority of websites
Client-side compatibility is handled by keeping the OS and browsers up-to-date
Utah has received well-earned national attention for a pro-business environment and its many successful technology and software companies.
Utah is a perfect candidate for promoting online safety and they can (and should!) lead by example.
Currently there's almost no HTTPS advocacy work happening at the State level.
Federal .GOV domains using HTTPS: Federal Pulse
Federal .GOV mandate: The HTTPS-Only Standard
HTTPS support of prominent websites: HTTPSwatch
SSL/TLS and PKI monthly news: Bulletproof TLS Newsletter
Quality of SSL across top 1 million websites: SSL Labs Pulse
SSL/TLS test with detailed results: Qualys SSL Labs
SSL/TLS test with detailed results: High-Tech Bridge
Best book to use: Bulletproof SSL and TLS
Mozilla's recommended TLS configs for server
Mozilla's SSL Configuration Generator
Google's web dev intro to TLS and HTTPS
Chromium's guide to TLS
CertSimple: What web devs should know about SSL
Cipherli.st: Strong ciphers for Apache, nginx and Lighttpd
TLS.builders: Code for OpenSSL on different servers
Evaluate HTTP response headers: securityheaders.io
Guides for HSTS-related issues
caniuse.com: Browser support of front-end web tech
sritest.io: Scan for Subresource Integrity
Twitter: @SecureUtah