<

Bram Verburg

Security advocate, BEAM enthusiast

Bram is an architect and security advocate with more than 20 years experience delivering complex software platforms to tier-1 telcos around the world, meeting their stringent security and reliability requirements.

He has been using Erlang, and later Elixir, since 2010. As a security advocate he has taken an interest in the security aspects of the Erlang/OTP ecosystem, as a blogger (at https://blog.voltone.net/), trainer, speaker, and open source contributor.

Past Activities

Bram Verburg
Code BEAM Lite Amsterdam 2018
30 Nov 2018
15.15 - 15.35

Learn you some 'ssl' for much security!

Erlang/OTP's built-in 'ssl' application forms the basis of many client and server packages. Unfortunately it has quite a few quirks, potentially leading to weak (or even broken) security. Many higher layer packages expose the 'ssl' application's socket options directly, with no additional defaults and little guidance on how to use them.

This talk highlights the most important client and server settings for 'ssl' sockets, how the defaults have evolved across OTP versions, and how popular libraries build on them. Topics include cipher suite selection, server hostname verification, known certificate issues (wildcard SAN, cross-signed CA), revocation checks, ECDSA servers, and more.

Practical code samples are given in Erlang and/or Elixir, as applicable.

OBJECTIVES

Learn to apply secure TLS configurations to clients and servers, either directly with the OTP 'ssl' application or through the many libraries that rely on it: Ranch, Cowboy, Plug, Phoenix, httpc, Hackney, HTTPoison, etc.