Ced_said

software developer.

[Ced_said @c_nak]

Functional programming with emoji #CFGConf16

[Stanislav Kozlovski @kozlovski]

HTTPS is used everywhere.

But most engineers can’t explain how it simply works.

Let’s change that.

HTTP is a protocol to exchange data, most popularly used between a web browser and a website. 💡

HTTPS is the secure version of that protocol. 🛡

Why is it secure?

Encryption. 😶‍🌫️

The data is encrypted so that only the web browser and the website can read it locally.

Without this, man-in-the-middle (MITM) attacks could intercept your traffic and read sensitive data like passwords, credit card details, etc. 😱

The protocol used to encrypt the data is TLS (Transport Layer Security).

HTTPS = HTTP + TLS. Simple as that.

HTTPS uses asymmetric cryptography to encrypt the data. You have:

🔑 a private key - the website’s SSL certificate’s secret key that isn’t shared with anyone.

🔑 a public key - the certificate’s public key, shared with everyone who wants to interact with the website.

💡 Asymmetric cryptography simply means information that’s encrypted by the public key can only be decrypted by the private key. And vice versa.

In contrast, symmetric cryptography is when only one key is used, and data can be encrypted/decrypted with that same key.

HTTPS actually uses both types! 😎

Asymmetric cryptography is used to verify the server and securely generate a session key that’ll be used for symmetric cryptography.

The session key, as it implies, only lives within the session and is used by both the client & server to encrypt/decrypt data.

Most interestingly, this key is deterministically generated by both the client and server independently - it never crosses the wire. 🪄

So. What are the steps?

1. Client (browser) connects to a server (web page)
2. Server sends its SSL certificate (includes the public key).
3. Client & Server do a TLS handshake & generate a session key to encrypt/decrypt future HTTP data.
4. Business as usual.

The details are in the TLS handshake, and that’s frankly the most interesting part of how HTTPS works.

The TLS handshake serves three purposes:

🧐 1. authenticate the identity of the server
✨ 2. generate session keys for encryption during this single session
🤝 3. decide which version of TLS and what cipher suites you’ll use

Step by step (RSA Algorithm):

1. Client Hello Request: The client initiates the handshake with a message including what TLS version and ciphers it supports, including a string of random bytes (client random)

2. Server Hello Response: The server chooses a cipher suite and generates its own random string bytes (server random). It responds with the suite, its SSL certificate, and the server random.

3. Client Verification: The client verifies the certificate via the trusted certificate authority that issued it. The SSL certificate has a digital signature that’s signed by the CA’s private key so the client uses the CA’s public key to decrypt it.

After this step, the Client has verified that the certificate is the legitimate one verified via the CA - not one fabricated on the fly.

Note it still doesn’t know for sure whether the server actually owns that certificate (i.e has the private key)

Side note: who says what Certificate Authority can be trusted?

Your browser’s provider!

Apple, Microsoft, Google, Mozilla and etc. all maintain their own lists of CAs.

Your browser and operating system ship with this list of trusted CAs.

It’s all based on “trust”, so you better trust them!

Anyway, continuing...

4. Client Key Exchange: The client creates a random string of bytes called the “premaster secret”. It encrypts it with the public key of the server it got from the SSL certificate and sends it over.

5. Session Key Generation: The server decrypts the premaster secret using the SSL certificate’s private key. Both the client and server, independently, generate session keys using the client random, server random, and the premaster secret.

Since they’re using the same data and deterministic algorithm, they should arrive at the same results. If they don’t - the subsequent encryption/decryption won’t result in the HTTP protocol.

💡 This step indirectly verifies to the client that the server has possession of the SSL certificate it presented (it didn’t just pretend to have it)

6. Done! The session key is now used to symmetrically encrypt/decrypt HTTP data.

[Ced_said @c_nak]

@HMRCcustomers Morning, I moved abroad 2 years ago, so I have a new address, new phone number, and a new phone device.
I'm currently unable to login using HMRC auth app, and can't answer the credit reference. Any advice?

[Scott Hanselman 🌮 @shanselman]

@GergelyOrosz @ppgosavi We stay positive by intentionality and deliberate empathy. One needs to spend time with humans, with young and early on career people, and in those moments recapture what it was like to be those people. That’s how I stay positive and non-salty. Salty is jaded. Recapture wonder.

[Ced_said @c_nak]

@RHeducation I'm one of the creators of this site, thank you so much for your kind words!

[Ced_said @c_nak]

@thiagoghisi @SaveToNotion
#thread

[Ced_said @c_nak]

@Prathamesh_117 @eddiejaoude That game was hilarious, spoke about it at a recent tech talk, too good to omit.

[Ced_said @c_nak]

@stephaniecodes agree with you on mobx, I grew tired of redux so I switched to mobx.... then realised that I disliked mobx more and decided just to use hooks and context

[Ced_said @c_nak]

@urlichsanais @SaraJaoude @SriSatya_ @eddiejaoude oh there's more @urlichsanais, but I'm not at liberty to share 😅

[Product Hunt 😸 @ProductHunt]

Use OCR to copy and paste code from screenshots
https://t.co/g2QpqLooE0

[Coding Black Females @codingblackfems]

We are looking for Instructors!

Join @Blackcodher in training 50 black women to become full stack developers! 🚀

Apply today: https://t.co/kTDdmSMelp

#BlackTechTwitter #womenintech #techbootcamp #blackcoders

[Ced_said @c_nak]

@UberEats hey we are having problems with our order, the driver doesn't want to deliver the food, can anyone help?

[Ced_said @c_nak]

@Cex Hi support, I've been incorrectly refunded into the wrong account. Any help appreciated

[Ced_said @c_nak]

@nowtvhelp I received a call, now trying to call back and it says number not recognised. Could you please call me back, thank you

[Ced_said @c_nak]

@profulsadangi https://t.co/3C0fyZvy5s

Nice one, Reminds me of this.

[Ced_said @c_nak]

Functional programming with emoji #CFGConf16

[Ced_said @c_nak]

@tanya_powell fairy floss was my favourite for a while, also on intelij.
https://t.co/7Bms96yknT

[Ced_said @c_nak]

@pinglinh @MyaElla @amllamojha wish there was an app for that.

[Baptiste Adrien @baptadn]

When dealing with SMS validation code form, don't forget to add the autocomplete attribute with the value "one-time-code".

It allows iOS to autofill the input with the incoming SMS 📩

[Palash @palashv2]

🔥 Log messages in console in any style you like using CSS

#100DaysOfCode #javascript #CodeNewbie

[Coding Black Females @codingblackfems]

This Friday we'll have @tanya_powell running an exciting session on 'life as a front end developer', if you'd like to join the session make sure you go to: https://t.co/R7pwFO1EVx to sign up!

#blackcodher #niyoenterprise #codingblackfemales #softwaredeveloper #blackwomencode

[Ced_said @c_nak]

@a_adewusi @ScalaBridgeLON @londonscala @Scalainthecity @gdndevelopers I know very little about Scala, only enough from my friend who was a former Guardian dev who raved about it. So it would be nice to know more about the basics and what makes it a nice language to work with.