Calm Down: HTTPS Is Not a VPN

Explore the limitations and misconceptions surrounding HTTPS in this 46-minute conference talk from AppSecEU 2016 in Rome. Delve into topics such as packet capture, OCSP, TLS exceptions, fingerprinting techniques, and privacy concerns related to HTTPS implementation. Gain insights into why HTTPS is not equivalent to a VPN and understand its implications for web security and user privacy across various platforms, including Android.

Intro
Welcome
About Dirk
Motivation
What if
HTTPS
HTTP
Why HTTPS is nonsense
Packet capture
Clearing
OCSP
Fingerprinting
TLS Exceptions
TLS fingerprinting
Client Hello
Client Time Off
Packets
Application Data
Website fingerprinting
trackers
security
Android
Conclusion
Privacy