Nisra16 你的 https 真的安全嗎？

•

42 gefällt mir•5,313 views

Huang-I Yang

你知道你有多少的密碼在網路上裸奔嗎？看到網站有綠色鎖頭就真的一定安全嗎？今天不跟你說艱深的密碼學，直接手把手教你如何辨識網路服務的安全性並且快速讓你網站服務有最基本的安全

Technologie

• HTTP HTTPS
◦ HTTPS
◦
•
◦
◦
◦ EV HTTPS
• HTTPS
◦
◦
◦
◦ Let’s Encrypt
• HTTPS
◦ SSLLAB
◦ HTTPS
◦ HTTPS
• DEMO QA

HTTPS
• -
• -
• - Google HTTPS SEO
• - Chrome Geolocation HTTPS
• - Apple iOS App 2017 HTTPS

• HTTPS
• IE Firefox Chrome
360 QQ .......
•

HTTPS  
HTTP TCP RTT  
HTTPS TCP + SSL RTT

$HTTPS   $ curl -w "TCP handshake: %{time_connect}, SSL handshake: % {time_appconnect}n" -so /dev/null https://www.alipay.com$

HTTPS
• SSLv2 SSLv3
• Cipher Strength MD5 1024 bit
• HSTS HTTP StrictTransport Security
• Perfect Forward Secrecy
• Weak Difﬁe-Hellman(DH)

MOZILLA SSL CONFIGURATION GENERATOR
https://mozilla.github.io/server-side-tls/ssl-conﬁg-generator/

HTTPS
• TLS False Start
• Certiﬁcate-Chain
• Session Resumption
• OCSP Stapling

HTTPS
• TLS False Start
Client Change Cipher Spec Finished
Application Data TLS
Application Data

HTTPS
• OCSP Stapling
OCSP
OCSP Stapling
OCSP
OCSP
Responder

Weitere ähnliche Inhalte

Andere mochten auch

How to boost your sales with cold emailingTheFamily

The Traffic Trifecta: Driving More Sales Through Paid Search + Organic Social...Internet Marketing Software - WordStream

The Top 10 Sales Conferences of 2016Peak Sales Recruiting

10 Awesome Hypnotherapy QuotesMindlife Hypnotherapy Singapore

Got Video?: Using Video to Speed up SalesPGi

Church Sermon: GW 1marikina4square

Building the Workforce for the Future: 16 Smart Inside Sales Trends in 2016 [...OpenView

Religion and The Walking deadMark Wheller

Technology in MinistryRon Hudson

Deepak Chopra: A Path to Personal ForgivenessDeepak Chopra MD (official)

The Art Of War In Sales - Derek GrantSalesLoft

[系列活動] 智慧製造與生產線上的資料科學 (製造資料科學：從預測性思維到處方性決策)台灣資料科學年會

Webinar how to scale a dream sales teamMindTickle

What Am I Chopped Lizard?Paul Bass

Migrating ODF and LibreOffice in Taiwanfweng322

She Did Not Consider Her DestinyDave Stewart

Andere mochten auch (16)

How to boost your sales with cold emailing

The Traffic Trifecta: Driving More Sales Through Paid Search + Organic Social...

The Top 10 Sales Conferences of 2016

10 Awesome Hypnotherapy Quotes

Got Video?: Using Video to Speed up Sales

Church Sermon: GW 1

Building the Workforce for the Future: 16 Smart Inside Sales Trends in 2016 [...

Religion and The Walking dead

Technology in Ministry

Deepak Chopra: A Path to Personal Forgiveness

The Art Of War In Sales - Derek Grant

[系列活動] 智慧製造與生產線上的資料科學 (製造資料科學：從預測性思維到處方性決策)

Webinar how to scale a dream sales team

What Am I Chopped Lizard?

Migrating ODF and LibreOffice in Taiwan

She Did Not Consider Her Destiny

Ähnlich wie Nisra16 你的 https 真的安全嗎？

HTTPS The Road To A More Secure Web / SEOCamp ParisAysun Akarsu

Everyone Screws Up HTTPSpatrickstox

Decentralized storage IPFS & UlordSteven Li

Creating Secure Web Apps: What Every Developer Needs to Know About HTTPS TodayHeroku

goaを使った開発TIPS@六本木一丁目jumpei chikamori

HTTP Security HeadersIsmael Goncalves

Internet of Things & E-commerceAqeel Ahmad

セキュアアプリケーションのためのHTTP設定ryusukekumita1

WebSocket - Nov 2011takanao ENODH

Cabeçalhos de Segurança HTTPIsmael Goncalves

PWA Roadshow Seoul - HTTPSChang W. Doh

DIY WordPress Site Management: Configure, Launch, and MaintainCliff Seal

Maximizing Performance with SPDY and SSLZoompf

Google's Search Signals For Page Experience - SMX Advanced 2021 Patrick StoxAhrefs

01_Migrate Web Sites to Azure Web Apps_GAB2019Kumton Suttiraksiri

Google drive on linux維泰蔡

The Future of https in Searchsemrush_webinars

OneDrive, TwoDrive, Whiterive, BlueDrive (hahaha)SPC Adriatics

Premature optimisation: The Root of All EvilFabio Akita

DevCommerce Conference 2016: Performance, anti-patterns e stacks pra desenvol...iMasters

Ähnlich wie Nisra16 你的 https 真的安全嗎？ (20)

HTTPS The Road To A More Secure Web / SEOCamp Paris

Everyone Screws Up HTTPS

Decentralized storage IPFS & Ulord

Creating Secure Web Apps: What Every Developer Needs to Know About HTTPS Today

goaを使った開発TIPS@六本木一丁目

HTTP Security Headers

Internet of Things & E-commerce

セキュアアプリケーションのためのHTTP設定

WebSocket - Nov 2011

Cabeçalhos de Segurança HTTP

PWA Roadshow Seoul - HTTPS

DIY WordPress Site Management: Configure, Launch, and Maintain

Maximizing Performance with SPDY and SSL

Google's Search Signals For Page Experience - SMX Advanced 2021 Patrick Stox

01_Migrate Web Sites to Azure Web Apps_GAB2019

Google drive on linux

The Future of https in Search

OneDrive, TwoDrive, Whiterive, BlueDrive (hahaha)

Premature optimisation: The Root of All Evil

DevCommerce Conference 2016: Performance, anti-patterns e stacks pra desenvol...

Kürzlich hochgeladen

Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun

A Year of the Servo Reboot: Where Are We Now?Igalia

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra

MINDCTI Revenue Release Quarter One 2024MIND CTI

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Principled Technologies

TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung

Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal

Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez

Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1

Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo

Boost PC performance: How more available memory can improve productivityPrincipled Technologies

Apidays New York 2024 - The value of a flexible API Management solution for O...apidays

2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong

Scaling API-first – The story of a global engineering organizationRadu Cotescu

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Kürzlich hochgeladen (20)

Powerful Google developer tools for immediate impact! (2023-24 C)

A Year of the Servo Reboot: Where Are We Now?

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

MINDCTI Revenue Release Quarter One 2024

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Boost Fertility New Invention Ups Success Rates.pdf

Exploring the Future Potential of AI-Enabled Smartphone Processors

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Boost PC performance: How more available memory can improve productivity

Apidays New York 2024 - The value of a flexible API Management solution for O...

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Scaling API-first – The story of a global engineering organization

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Nisra16 你的 https 真的安全嗎？

1. HTTPS Henry@NISRA 2016/12/19

2. • HTTP HTTPS ◦ HTTPS ◦ • ◦ ◦ ◦ EV HTTPS • HTTPS ◦ ◦ ◦ ◦ Let’s Encrypt • HTTPS ◦ SSLLAB ◦ HTTPS ◦ HTTPS • DEMO QA

3. HTTPS

4. HTTP

5. HTTPS TCP HTTP TLS

8. HTTPS

10. HTTPS • - • - • - Google HTTPS SEO • - Chrome Geolocation HTTPS • - Apple iOS App 2017 HTTPS

11. HTTPS V.S. HTTP HTTP = HTTP

12. •   HTTPS -

13.

14. HTTPS HTTPS -

15.

16. • • DNS • ...

17.

18. SHA1

19.

20.

21.

22.

23.

24. SINGLE DOMAIN WILD CARD

25. SINGLE DOMAIN WILD CARD

26.

27. /

28.

29.

30.

31. ... ...

32. VERISIGN ...

33. • Privacy Key • • •

34. ...

35. • HTTPS • IE Firefox Chrome 360 QQ ....... •

36. LET'S ENCRYPT • • 90

37. GEA-SUAN LIN HTTPS://LETSENCRYPT.TW/

38.

39. HTTPS SSLAB • • • F

40. HTTPS A+ F

41.

42.

43. TESTSSL.SH https://testssl.sh/

44. HTTPS

45. HTTPS • • • •

46. HTTPS   HTTP TCP RTT   HTTPS TCP + SSL RTT

47. HTTPS   $ curl -w "TCP handshake: %{time_connect}, SSL handshake: % {time_appconnect}n" -so /dev/null https://www.alipay.com

48. HTTPS • • HTTPS • HTTPS

49. HTTPS • HTTPS • •

50. HTTPS • IE6

51. HTTPS

52. HTTPS

53. HTTPS • SSLv2 SSLv3 • Cipher Strength MD5 1024 bit • HSTS HTTP StrictTransport Security • Perfect Forward Secrecy • Weak Difﬁe-Hellman(DH)

54.

55. CIPHERLI.ST https://cipherli.st/

56.

57. MOZILLA SSL CONFIGURATION GENERATOR https://mozilla.github.io/server-side-tls/ssl-conﬁg-generator/

58. HTTPS

59. HTTPS • TLS False Start • Certiﬁcate-Chain • Session Resumption • OCSP Stapling

60. HTTPS • TLS False Start Client Change Cipher Spec Finished Application Data TLS Application Data

61. HTTPS • Certiﬁcate-Chain -> -> ECC

62. HTTPS • Session Resumption RTT

63. HTTPS • OCSP Stapling OCSP OCSP Stapling OCSP OCSP Responder

64. HTTPS HTTPS

65. DEMOTIME

Nisra16 你的 https 真的安全嗎？

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Andere mochten auch

Andere mochten auch (16)

Ähnlich wie Nisra16 你的 https 真的安全嗎？

Ähnlich wie Nisra16 你的 https 真的安全嗎？ (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Nisra16 你的 https 真的安全嗎？