lightning talk @ CGNwebperf 2018

1. HSTS: Improving Security Without Losing Performance
#CGNwebperf #25 Cologne, 6 December 2018
Ingo Steinke @fraktalisman
Sevenval Technologies GmbH
sevenval.com wao.io

2. HSTS: Improving Security Without Losing Performance
Hypertext
Strict
Transport
Security

3. ? HSTS
+
HTTP/2
+
TLS 1.3
+
Let’s Encrypt
(Ilya Grigorik, Velocity 2014) 2018
(Illustration © Jonathan Burton)

4. HSTS
Reduce
Round
Trips
307 Internal Redirect

5. HSTS Header
hstspreload.org
Strict-Transport-Security: max-age=31536000
HSTS Cache:
chrome://net-internals/hsts#hsts
HSTS Preload List

6. HSTS Header
Strict-Transport-Security:
max-age=31536000
includeSubDomains
http://old.legacy.domain.i.forgot.com/

7. HTTPS && B
HTTPS && Brotli
HTTPS && Brotli
Most new performance features require HTTPS.

8. Most new performance features require HTTPS.
S W
Image © Microsoft

9. HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3
HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS
TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS
HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2
HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3
HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS
TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS
HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3
do it yourself wao.io, cloudflare, ...
Just do it !
© IKEA

10. developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
hstspreload.org
en.wikipedia.org/wiki/Brotli
istlsfastyet.com
blog.wao.io/tls-1-3
HSTS: Improving Security Without Losing Performance

11. HSTS: Improving Security Without Losing Performance
#CGNwebperf sevenval.com wao.io
Thanks! && Questions?