HTML5 security
-
date post
17-Oct-2014 -
Category
Technology
-
view
489 -
download
0
description
Transcript of HTML5 security
HTML5 SecurityWilliam J. Edney
Technical Pursuit Inc.
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Clarification
• Much of what is termed “HTML5”, insofar as new programming capability is concerned, is really not HTML. It is really more JavaScript API added to the browser.
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
“Hot button” issue
• Much of ‘external facing’ computing is done on the Web these days
• E-commerce
• Customer care
• Partner collaboration
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
What hasn’t changed: Same Origin Model
• Core of web security
• Same host
• Same protocol
• Same port
• XMLHTTPRequest is bound by this model
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
What hasn’t changed: Extensions / addons
• Browsers can get access to:
• Bookmarks
• File system
• Cross-origin XHR
• Require extra user permission to install
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
“HTML5” additions• Cross-Origin Resource Sharing (CORS)
• [Web, DOM, Local] Storage
• Indexed DB (supplants WebDB)
• Offline Apps (‘HTML5 manifest’)
• Geolocation API
• Downloadable Fonts
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
“HTML5” additions
• Cross-window messaging (‘postMessage’)
• Filesystem APIs
• Device APIs (Camera, GPS, etc.)
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Future
• Web Crypto
• Web Real Time Communication (WebRTC)
• Today in Chrome and Firefox
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Relaxing same-origin• document.domain property
• siteA.foo.com and siteB.foo.com can become ‘foo.com’ and communicate
• JSONP
• HTML5: CORS
• HTML5: postMessage()
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Core issues
• No fine-grained security model
• ‘Same origin’ policy is the master for the foreseeable future
• Some APIs prompt the user for permission
• Users are becoming overwhelmed
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
API Recommendations• CORS
• For intranet/extranet data-sharing, use specific domains - not
“Access-Control-Allow-Origin: *”
• [Web, DOM, Local] Storage
• Use encryption, if available
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
API Recommendations
• IndexedDB
• Use encryption, if available
• Offline Apps
• Geolocation API
• Intranet/Extranet: Use sparingly
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
API Recommendations
• Downloadable fonts:
• Intranet/Extranet: Don’t use them
• Cross-window messaging (‘postMessage’)
• Intranet/Extranet: Use sparingly
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
API Recommendations
• Filesystem APIs
• Intranet/Extranet: Don’t use them
• Device APIs
• Intranet/Extranet: Use sparingly
• x-frame-options HTTP header
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Future
• W3C has begun work on the “Content Security Policy”
• Fine-grained, cross API, security mechanism
• Currently a candidate recommendation
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Organizational policies• Use different browsers (or browser
profiles) for tasks requiring different levels of security
• IE for work, FF for play / personal
• Use work machine / browser only for work
• Use own device for personal
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Conclusion• Browsers are becoming more powerful
• Users will upgrade
• Users will find ways around your attempts to prevent them from upgrading
• As with much of IT security, the real solution lies in education and organizational policy
Thursday, May 16, 13
William J. Edney Technical Pursuit Inc.
Questions?
• Thanks!
Thursday, May 16, 13