Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm...
Transcript of Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm...
![Page 2: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/2.jpg)
YESTERDAY
![Page 3: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/3.jpg)
![Page 4: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/4.jpg)
June 5, 2002!
![Page 5: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/5.jpg)
![Page 6: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/6.jpg)
Bugs. :-(
![Page 7: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/7.jpg)
![Page 8: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/8.jpg)
![Page 9: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/9.jpg)
CSS HISTORY SNIFFING
![Page 10: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/10.jpg)
JSFunFuzzhttp://www.squarefree.com/2007/08/02/introducing-jsfunfuzz/
![Page 11: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/11.jpg)
1024 bugs since 21-August 2006118 security critical
![Page 12: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/12.jpg)
Oh dear...
Image Credit: Randal Alan Smith / http://valleywag.gawker.com
![Page 13: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/13.jpg)
Oh dear...
( Brendan Eich )( Invented JavaScript )
Image Credit: Randal Alan Smith / http://valleywag.gawker.com
![Page 14: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/14.jpg)
EYEBALLS
![Page 15: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/15.jpg)
TODAY
![Page 16: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/16.jpg)
November 9, 2004!
![Page 17: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/17.jpg)
![Page 18: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/18.jpg)
![Page 19: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/19.jpg)
BUG BOUNTIES
![Page 20: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/20.jpg)
FUZZING
![Page 21: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/21.jpg)
Browser as Protector
![Page 22: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/22.jpg)
Safe Platform
![Page 23: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/23.jpg)
Safe Browsing (Google)
![Page 24: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/24.jpg)
AddOns
![Page 25: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/25.jpg)
Out-Of-Process Plugins
![Page 26: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/26.jpg)
Out-Of-Process Plugins
![Page 27: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/27.jpg)
Out-Of-Process Plugins
![Page 28: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/28.jpg)
Out-Of-Process Plugins
![Page 29: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/29.jpg)
Out-Of-Process Plugins
![Page 30: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/30.jpg)
SECURITY FEATURES
![Page 31: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/31.jpg)
CSS HISTORY SNIFFING
![Page 32: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/32.jpg)
BETTERTRUST
![Page 33: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/33.jpg)
PRIVACY
![Page 34: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/34.jpg)
TOMORROW
![Page 35: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/35.jpg)
FirefOS®
![Page 36: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/36.jpg)
FirefOS®
( Okay, not really )
![Page 37: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/37.jpg)
Canvas
CSS3 Transformations
Direct2D
Drag & Drop
FileAPI
Geolocation
HTML5 Forms
MathML
Open Video/WebM
SVG
WebGL
WebSockets
Web Storage (SQL)
Web Workers
![Page 38: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/38.jpg)
0%
25%
50%
75%
100%
2004 2006 2008 2010 2012
Percent of Your Computer’s Abilities used by Web Sites
YouTube
Google DocseBayNintendo Emulator
![Page 39: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/39.jpg)
AddOns
![Page 40: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/40.jpg)
Jetpack
My Add-On
Jetpack Backend
(XPCOM)
modulemodulemodulemodulemodulemodule
API
![Page 41: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/41.jpg)
Jetpack
My Add-On
Jetpack Backend
(XPCOM)
modulemodulemodulemodulemodulemodule
API
JavaScript
![Page 42: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/42.jpg)
Jetpack
My Add-On
Jetpack Backend
(XPCOM)
modulemodulemodulemodulemodulemodule
API
Capabilities:1. http://foo.com2. graphics3. menus
![Page 43: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/43.jpg)
MULTI-PROCESS ARCHITECTURE
![Page 44: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/44.jpg)
ACCOUNT MANAGER
(concept)
![Page 45: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/45.jpg)
BETTERERTRUST
![Page 46: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/46.jpg)
PRIVACY
![Page 47: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/47.jpg)
OPEN QUESTIONS
![Page 48: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/48.jpg)
PRIVACY?
![Page 49: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/49.jpg)
ANONYMITY?
![Page 50: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/50.jpg)
BETTERESTTRUST? ?
![Page 51: Staying Safe on the Web - USENIX · Staying Safe on the Web Yesterday, Today and Tomorrow Sid Stamm YESTERDAY. June 5, 2002! Bugs. :-(CSS HISTORY SNIFFING.](https://reader034.fdocuments.us/reader034/viewer/2022042220/5ec61f28cf1ca866e4156538/html5/thumbnails/51.jpg)
SOCIO-TECHNICAL SECURITY?