better safe than sorry with https by patrick stox

#SMX #24A3 @patrickstox

The Good, the Bad, and the Terrifying

Better Safe Than Sorry With HTTPS


You Know You Should Have Switched Right? Text Slide with Solid Blue Banner:

ThisblanklayoutoffersyouflexibilitytoinsertyourownstandardslidesabovetheSMXfooterYOUMUSTUSETHISFOOTERATMINIMUMONALMOSTALLOFYOURSLIDES.Ifascreenshotoverlapsthefooteronoccasion,that’sfine–butdoyourbesttocropappropriately.Ifexplicitfontsareimportant,youmayprovideapdftotheeventorganizerstomaintainlook&feelduringlivepresentationandintheversionsmxwilluploadtoslideshare.DELETETHISSLIDEIFYOUDONOTUSE.


THE INFORMATION Text Slide with Solid Blue Banner:



HTTPSEverywherehttps://www.youtube.com/watch?v=cBhZ6S0PFCY

HTTPSasaRankingSignalhttps://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html

HTTPSbyDefaulthttps://webmasters.googleblog.com/2015/12/indexing-https-pages-by-default.html

Text Slide with Solid Blue Banner:



Then There’s This Guy Text Slide with Solid Blue Banner:



SecuringYourWebsiteWithHTTPShttps://support.google.com/webmasters/answer/6073543

Google Wrote A Guide To Help Text Slide with Solid Blue Banner:



HTTPtoHTTPS:AnSEO’sguidetosecuringawebsitehttp://searchengineland.com/http-https-seos-guide-securing-website-246940

I Also Wrote A Guide To Help Text Slide with Solid Blue Banner:



https://plus.google.com/+JohnMueller/posts/PY1xCWbeDVC

John Mueller Wrote An FAQ Text Slide with Solid Blue Banner:



John Mueller Liked My Guide Text Slide with Solid Blue Banner:



Why Aren’t People Adopting? Text Slide with Solid Blue Banner:



Top Ranking Sites Are Adopting Text Slide with Solid Blue Banner:

ThisblanklayoutoffersyouflexibilitytoinsertyourownstandardslidesabovetheSMXfooterYOUMUSTUSETHISFOOTERATMINIMUMONALMOSTALLOFYOURSLIDES.Ifascreenshotoverlapsthefooteronoccasion,that’sfine–butdoyourbesttocropappropriately.Ifexplicitfontsareimportant,youmayprovideapdftotheeventorganizerstomaintainlook&feelduringlivepresentationandintheversionsmxwilluploadtoslideshare.DELETETHISSLIDEIFYOUDONOTUSE. @methodeisGoogleWebmasterTrendsAnalystGaryIllyes

Dr.PeteMeyersofMozranatestandshowedover30%offirstpageresultsweresecureinJune2016.https://moz.com/blog/https-tops-30-how-google-is-winning-the-long-war


THE GOOD Text Slide with Solid Blue Banner:



AuthenticationThisiswhoI’msupposedtobetalkingto

DataIntegrityWhoismessingwithmystuff

EncryptionWhoislistening

What Does TLS Offer? Text Slide with Solid Blue Banner:



WhengoingfromHTTPS>HTTP,referraldataisdropped.HTTPS>HTTPS,HTTP>HTTP,andHTTP>HTTPSDOpassthevalue.Thisaccountsforalotofwhatpeoplecall“DarkTraffic”and“DarkSocial”.SwitchingtoHTTPSfixessomeoftheseattributionerrors.Withoutthisreferraldata,thetrafficlookslikeit’sdirecttraffic.

Referral Data Text Slide with Solid Blue Banner:


HTTP HTTPS

HTTP Yes Yes

HTTPS No Yes


Readanyoftheguidesoutthere.Theymakeitsoundsoeasybecauseitcanbe.

Moving To HTTPS Is A Website Migration Text Slide with Solid Blue Banner:



Let’sEncrypthttps://letsencrypt.org/

HostsareofferingthemCDNsareofferingthem

Free Certificates Text Slide with Solid Blue Banner:



What’stheonethingeveryoneknowsaboutAMP?It’sFASTright,butwhy?

AMP Text Slide with Solid Blue Banner:



SingleConnection.Onlyoneconnectiontotheserverisusedtoloadawebsite,andthatconnectionremainsopenaslongasthewebsiteisopen.ThisreducesthenumberofroundtripsneededtosetupmultipleTCPconnections.Multiplexing.Multiplerequestsareallowedatthesametime,onthesameconnection.Previously,withHTTP/1.1,eachtransferwouldhavetowaitforothertransferstocomplete.ServerPush.Additionalresourcescanbesenttoaclientforfutureuse.

HTTP/2 – So Much Goodness Text Slide with Solid Blue Banner:



Prioritization.Requestsareassigneddependencylevelsthattheservercanusetodeliverhigherpriorityresourcesfaster.Binary.MakesHTTP/2easierforaservertoparse,morecompactandlesserror-prone.Noadditionaltimeiswastedtranslatinginformationfromtexttobinary,whichisthecomputer’snativelanguage.HeaderCompression.HTTP/2usesHPACKcompressions,whichreducesoverhead.ManyheadersweresentwiththesamevaluesineveryrequestinHTTP/1.1.CloudFlaresawa30%reductioninsize.

HTTP/2 – Even More Goodness Text Slide with Solid Blue Banner:



http://searchengineland.com/everyone-moving-http2-236716

HTTP/2 – Read About It Text Slide with Solid Blue Banner:



•  Forevery100msdecreaseinhomepageloadspeed,Mobify'scustomerbasesawa1.11%liftinsessionbasedconversion,amountingtoanaverageannualrevenueincreaseof$376,789

•  Forevery100msdecreaseincheckoutpageloadspeed,Mobify'scustomerssawa1.55%lifeinsessionbasedconversion,amountingtoanaverageannualrevenueincreaseof$526,147

•  Shoppersbrowsemoreonfastermobilewebsites

•  Anincreaseofonepageviewperuserresultsina5.17%liftinuserbasedconversion,i.e.foreachadditionalpageviewedperuser,Mobifysawtheiraveragecustomer'sannualrevenueincreaseby:$398,484

Mobify’s Mobile Test Text Slide with Solid Blue Banner:



THE BAD Text Slide with Solid Blue Banner:



Whatifyou’reawebsitewhomakesmoneybysendingpeoplefromyourwebsitetoanotherwebsite?Affiliates,Directories,NicheMagazines.Youneedthatreferraldatatoproveyourvalue!

Referral Data – Didn’t We Say This Was Good? Text Slide with Solid Blue Banner:



HardModeLoadbalancers,CDNs,legacyinfrastructure,legacysoftware,multipleCMSsystems,routing,APIsMovingtoHTTPS,anewCMS,bringinginoutsidedomains,newtaxonomy,newcontent,killingoldcontent,redirects,redirects,andmoreredirects

Moving To HTTPS Is A Website Migration Text Slide with Solid Blue Banner:



There’sadifferencebetweengettingitdoneandgettingitdonecorrectly.There’ssomehardchoicesthatpeoplearen’twillingtomakelikechangingproviders,upgradingsystems,orjustkillingoffthings.

Is It Harder For Bigger Companies? Text Slide with Solid Blue Banner:



Making The Switch To HTTPS Can Go Wrong, Ask Buffer Text Slide with Solid Blue Banner:



https://www.wired.com/2016/05/wired-first-big-https-rollout-snag

https://www.wired.com/2016/08/wired-https-progress/

Wired’s Transition To HTTPS Text Slide with Solid Blue Banner:



https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

Chrome Text Slide with Solid Blue Banner:



TheylookedataccessibilityviaHTTPandHTTPS,redirects,andstatuscodes.•  1in10websiteshadwhattheyconsideredaflawlessHTTPSsetup.

•  60%ofthewebsitestestedhavenoHTTPSwhatsoever(increasingtoover65%whentakingintoaccountwebsiteswitherrorsinSSLsetup).

•  Almost1in4domainsweremissingacanonicalHTTPSversion.

•  Almost1in4domainswereusing302(temporary)redirectsinsteadof301(permanent)redirects.

•  EvenGooglecan’tbebotheredtousepermanentredirectsandusestemporaryredirects(HTTPstatuscode302)instead.

LinksSpy Analyzed 10,000 Top Domains Text Slide with Solid Blue Banner:



THE TERRIFYING Text Slide with Solid Blue Banner:



Doyouwanttobede-indexedbyBingandBaidu?

TLS SNI Text Slide with Solid Blue Banner:



Injection



Happensallthetimewithhotelchains,airlinesandISPs.AT&TInjectingAdshttp://webpolicy.org/2015/08/25/att-hotspots-now-with-advertising-injection/

ComcastblockingVPNTraffichttps://blog.wjd.io/comcast-blocks-vpn-traffic

ComcastagainInjectingAds------------à


Headline Text Slide with Solid Blue Banner:



Thinkwhatcouldhappenwhenacountrycontrolsthedata.i.e.TheGreatFirewall

Injection Is Scary Enough, Censorship Is Terrifying Text Slide with Solid Blue Banner:



DidyouknowGitHubwasDDoSattacked.TheattackershijackedHTTPconnectionsandrewrotetheBaidutrackingcodewithmaliciousJSthatattackedtwoGitHubprojectsthatfocusedonChineseanti-censorship.http://www.infoworld.com/article/2903533/security/github-still-recovering-from-massive-ddos-attacks.html

Or How About Attacks? Text Slide with Solid Blue Banner:



Many Apps Send Data Over HTTP Text Slide with Solid Blue Banner:


Theyaskforsomanypermissionsandthentheydosomethinglikethis.It’soneofthemostterrifyingthingsI’veseeninmylife.


Butmorethanlikelyyourdatawasalreadystoleninoneofthemanydatabreaches:https://haveibeenpwned.com/

Sending Your Data Openly is Scary Text Slide with Solid Blue Banner:



RouterModemISPWhatelseisbetweenthepersonandtheserverorCDN?

Just Because Your Site Shows Secure, Not Everything Is Text Slide with Solid Blue Banner:



https://www.troyhunt.com/understanding-http-strict-transport/

TheguytakesaWifiPineapplewithhimandshowshowwebsitesnotusingHSTS,i.e.thefirstrequestisstillHTTP,canbehijackedifthey’reconnectedtoyourwifi.

Troy Hunt Is My Hero




THE IMPROVEMENTS Text Slide with Solid Blue Banner:



https://istlsfastyet.com/

TLS Improvements By Server Text Slide with Solid Blue Banner:



https://istlsfastyet.com/

TLS Improvements By CDN Text Slide with Solid Blue Banner:



HighPerformanceBrowserNetworkingbyIlyaGrigorikhttp://chimera.labs.oreilly.com/books/1230000000545

OpenSSLCookbook&BulletproofSSLandTLSbyIvanRistichttps://www.feistyduck.com/books/openssl-cookbook/https://www.feistyduck.com/books/bulletproof-ssl-and-tls/

https://wiki.mozilla.org/Security/Server_Side_TLS

Performance Resources Text Slide with Solid Blue Banner:



https://www.ssllabs.com/ssltest/

Theyalsohaveabestpracticeguide:https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices

Test Your Server Text Slide with Solid Blue Banner:



LEARN MORE: UPCOMING @SMX EVENTS

THANK YOU! SEE YOU AT THE NEXT #SMX

better safe than sorry with https by patrick stox

Marketing