Presentación
Vídeo
Transcripción
Extracto de la transcripción automática del vídeo realizada por YouTube.
good afternoon everybody thank you so much for coming and joining us today after lunch I know you are quite sleepy but I hope this is going to be a very exciting talk Kinnick is going to be talking to us a little bit about like ssl you know that thing we use
please a big round of applause branic yes the onus so a quick poll will also difference between SSL and TLS okay okay okay it's good good the rest of you either shy or in a very right room so I'm Hennig this is how I look on the Internet um when I'm
not allowed on Twitter or writing some open source of the four Great a good I'm doing infrastructure at a small about friendly German by posting company called very media where if you speak German should get your all your remains from but I'm not here
to talk about myself I'm here to tell you that those shiny logins to tell you it you're safe because of military-grade encryption or a lie in fact your honor never really safe and while this statement may have seemed a bit controversial last week I
assure you that in a grand scheme of things absolutely nothing changed since last Sunday you simply need to know how things fit together in order to assess and minimize risks and youk you and your usage of TLS and ssl can do much more damage than any buck
will ever do so before we do our first step together I'd me introduce you the only link we have to write down today every other link and project and for a material I will be mentioning today will be there especially more material to dive deeper into the
concepts I'm introducing because a theme I think 40 minutes for such complex our topic like TLS is way too little so now just relax and enjoy the show what why is the state of SSL sorry maybe should start at Ground Zero and discuss what it actually is
so what's SSL and what the hell has it to do with he LS I think those terms are best explained with a short history lesson because everybody loves history lessons and our particular one starts in the mid-90s the Netscape thought it might be pretty cool
if entering your credit card number on the internet would entail people buying drugs out of your money and so in 1995 they released the completely host SSL to as the foundation for HTTPS where the S stands for secure not for SSL and they fix the most wat worst
parts one year later with ssl three and another three years later it finally became an official IETF standard and was renamed to TLS so again SSL is a product from Netscape from 1996 TLS is an official standard for 15 years now so basically I tricked you in
here with the name but everybody knows that alliterations are always awesome and I wanted to reach everyone I could so if I had to trick you in with the name I hope you learned the first thing today and we'll stop saying as a cell in a future in two thousand
six and two thousand eight the largely ignored TLS 1.1 and 1.2 have been released both fixed several security problems bro really nice features but nobody cared fast forward last year for some totally random reason people started scrutinizing our security
habits again and what they found was really not very good so for one all mainstream browsers are supported only TLS one and the last year so TLS one from 1999 and the discoveries from last year changed everything the times are just using TLS are gone for myself
it rather makes me very suspicious than reassured when some software claims to be secure because of TLS actually they're mostly says SSL which makes me double suspicious so you really need to know roughly what you're doing because this technology has
still very sharp edges and getting it wrong have very grave consequences so what does TLS actually want to provide you with first there's peer identity using certificates so you can verify your connecting to the pier you actually wanted to connect and
also some crook who tricked you into connecting to their server then it gives you confidentiality using encryption so people dropping on your network which is not any dark magic can sniff out your secret and your password this is what most people think of
anything of ssl/tls and crypt or cryptography in general but it's only a third of the whole package the last part is message integrity so yeah the protocol is able to detect when packages arrive mangled out of order multiple times or not at all so that's
that's basically TLS in a nutshell now let's look on how to use those and explain further details along the way so after spot you'll be able to spot the worst smells of poo TLS usage and you will note what to avoid and we will start with servers
unless noted I'm sticking to openssl throughout the rest of the talk because that's what we will most likely be using whether you like it or not so and if you deploy server software it's a duty to ensure the maximum security for your users because
they can neither see nor affect your setup so the first step is to use as at least half way up to date versions of third-party software if you deploy anything order in these versions today you are being negligent lazy and should stop doing so and I'm generously
assuming that you installed all the security backpack ports and patches from your distribution's these are the feature releases you need to have a half a secure setup of your TLS if you don't use the relevant backports there's obviously no no way
you are deploying openssl older than one point a point 1 g which came out monday as you may have heard so the first thing you do when a client connects to you is that you present them a certificate that says who you are which the client should verify in order
to make the client actually trust the certificate your Senate it has to be signed by a trusted third party called a certificate authority or CA the set of all public keys of all trusted cas that can be used to verify the certificate these signatures is what
we call a trust database or trust store or system keyring it depends on an architecture and the operating system oh it's called and to prove the certificate is actually yours after all you send it out to everyone so a secret key belongs which certificate
this key is then used for signatures it can be verified with the certificate and they prove that you're actually in a possession of the secret key or at you for no server with heartbleed so in the simplest case CS vouch that they verified that a certain
hostname belongs to you by checking that you gave them money and control a DNS for the domain it's called hostname verification and those certificates are really cheap and you think you can get him even for free nowadays on our side of the spectrum is
extended validation it obviously also means extended payment and that gets your company name into the URL bar and it's basically always to know information about validity plus signature from trusted third-party equals certificate your job now is to make
sure that your certificate setup is trustworthy because the TLS is really worthless if the connecting plants have no way to verify your identity so you won't get a certificate signed by a trusted third party um when you get a so called chain file which
contains one or more intermediate certificate that completed trust past 21 so in this case the edge trust CA signed some Komodo certificate which in turn signed some other Komodo certificate which in turn finally site my certificate now when a client connects
it gets all three of them and then it can verify that trust chain so take care of the trust chain forgetting change certificates is a typical rookie mistake ensure that the certificate is valid for the host name of your server and finally make sure that the
[ ... ]
Nota: se han omitido las otras 3.870 palabras de la transcripción completa para cumplir con las normas de «uso razonable» de YouTube.