2014.10.29 - Security@Scale - Jim O'Leary, Twitter
summary
Twitter migrates the entire service from mixed HTTP to HTTPS by default, moving users from opt‑in to forced SSL, adding a HSTS header (with preload) and 301 redirects, shifting APIs and third‑party clients to TLS, deploying certificate pinning in owned apps, enabling forward secrecy, and using content security policy report-only then enforce to catch mixed content. Teams run blackout tests, log protocol usage to measure SSLv3 impact, open‑source secure_headers, and report that overall latency improves after full HTTPS rollout.
AI-written summary · about
chapters (7)
related talks
58m25 Years of SSL - Secure(ish) Sockets Layer
43mEmerging Web Security Standards
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
48mOvercoming a million reasons not to be HTTPS only
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
53mHansel and Gretel do TLS
53m25 Years of SSL - Secure(ish) Sockets Layer
57mSecurity