105
Security and Privacy on the Web in 2015 François Marier @fmarier mozilla

Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

  • Upload
    others

  • View
    3

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Security and Privacyon the Web in 2015

François Marier @fmarier mozilla

Page 2: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

FirefoxSecurity & Privacy

Page 3: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Web Platform

Page 4: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Web Platform

Page 5: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content Security Policyaka CSP

Page 6: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content Security Policyaka CSP

mechanism for preventing XSS

Page 7: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

telling the browser what externalcontent is allowed to load

Page 8: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Hi you<script>alert('p0wned');</script>!

Tweet!

What's on your mind?

Page 9: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

without CSP

Page 10: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Hi you!John Doe - just moments ago

p0wnedOk

Page 11: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

with CSP

Page 12: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Hi you!John Doe - just moments ago

Page 13: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content-Security-Policy:

script-src 'self'

https://cdn.example.com

Page 14: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

inline scripts are blocked unlessunsafe-inline is specified

Page 15: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

script-srcobject-srcstyle-srcimg-srcmedia-srcframe-srcfont-src

connect-src

Page 16: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

$ curl --head https://twitter.comHTTP/1.1 200 OKcontent-length: 58347content-security-policy: …report-uri https://twitter.com/csp_report

violation reports:

Page 17: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

"csp-report": { "document-uri":

"http://example.org/page.html", "referrer":

"http://evil.example.com/haxor.html", "blocked-uri":

"http://evil.example.com/image.png", "violated-directive": "default-src 'self'", "effective-directive": "img-src", "original-policy":

"default-src 'self';report-uri http://example.org/..."

}

Page 19: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

support for inline scripts

Content-Security-Policy:

script-src 'sha256-YWIzOW...'

Page 20: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 21: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Strict Transport Securityaka HSTS

Page 22: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Strict Transport Securityaka HSTS

mechanism for preventingHTTPS to HTTP downgrades

Page 23: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

telling the browser that your siteshould never be reached over HTTP

Page 24: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 25: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

GET banque.fr 301→

GET https://banque.fr 200→

no HSTS, no sslstrip

Page 26: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

GET banque.fr → 200

no HSTS, with sslstrip

Page 27: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

what does HSTS look like?

Page 28: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

$ curl -i https://example.comHTTP/1.1 200 OKCache-Control: privateContent-Type: text/html; charset=utf-8Strict-Transport-Security: max-age=31536000...

Page 29: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

with HSTS, with sslstrip

GET https://banque.fr 200→

Page 30: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

silent client-side redirectsHTTP → HTTPS

Page 31: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

no HTTP traffic forsslstrip to tamper with

Page 32: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

except for the veryfirst connection

Page 33: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

https://hstspreload.appspot.com/

Page 34: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 35: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

coming up in 2015

Page 37: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 38: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 39: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

https://ajax.googleapis.com

/ajax/libs/jquery/1.8.0/

jquery.min.js

Page 40: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

how common is this?

Page 41: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 42: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

what would happen if thatserver were compromised?

Page 43: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 44: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Bad Things™

steal sessionsleak confidential dataredirect to phishing sitesenlist DDoS zombies

Page 45: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

simple solution

Page 46: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

instead of this:

<scriptsrc=”https://ajax.googleapis.com...”>

Page 47: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

<scriptsrc=”https://ajax.googleapis.com...”integrity=”sha256-1z4uG/+cVbhShP...”>

do this:

Page 48: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

guarantee:script won't changeor it'll be blocked

Page 49: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

limitation:won't work for scriptsthat change all the time

Page 50: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

https://ajax.googleapis.com

/ajax/libs/jquery/1.8.0/

jquery.min.js

Page 51: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

there's a little something missing...

Page 52: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

<script

src=”https://ajax.googleapis.com...”

integrity=”sha256-1z4uG/+cVbhShP...”

crossorigin=”anonymous”>

complete example:

Page 54: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

“a web browser permits scripts contained in a firstweb page to access data in a second web page,but only if both web pages have the same origin”

same-origin policy

Page 55: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

example.com/index.html

Page 56: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

example.com/index.html

example.com/data.js:

var secret = 42;

Page 57: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

example.com/index.html

example.com/data.js:

var secret = 42;

evil.net/widget.js:

exfiltrate(secret);

Page 58: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

example.com/index.html

example.com/data.js:

var secret = 42;

evil.net/widget.js:

exfiltrate(secret);

Page 59: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

on the server:

Access-Control-Allow-Origin: *

Page 60: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

on the server:

Access-Control-Allow-Origin: *

on the client:

crossorigin=”anonymous”

Page 61: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

<script

src=”https://ajax.googleapis.com...”

integrity=”sha256-1z4uG/+cVbhShP...”

crossorigin=”anonymous”>

complete example:

Page 62: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

<link rel="stylesheet"

href="style.css"

integrity="sha256-PgMdguwx/O..."

crossorigin=”anonymous”>

complete example:

Page 63: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

SRIhash.org

Page 64: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 66: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 67: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

http://example.com/search?q=serious+medical+condition

Click here for the cheapest

insurance around!

Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.

Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.

Page 69: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

No ReferrerNo Referrer When DowngradeOrigin OnlyOrigin When Cross OriginUnsafe URL

Page 70: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

No ReferrerNo Referrer When DowngradeOrigin OnlyOrigin When Cross OriginUnsafe URL

Page 71: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

No ReferrerNo Referrer When DowngradeOrigin OnlyOrigin When Cross OriginUnsafe URL

Page 72: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

No ReferrerNo Referrer When DowngradeOrigin OnlyOrigin When Cross OriginUnsafe URL

Page 73: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

No ReferrerNo Referrer When DowngradeOrigin OnlyOrigin When Cross OriginUnsafe URL

Page 74: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content-Security-Policy: referrer origin;

<meta name="referrer" content="origin">

<a href="http://example.com" referrer="origin">

Page 75: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content-Security-Policy: referrer origin;

<meta name="referrer" content="origin">

<a href="http://example.com" referrer="origin">

Page 76: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Content-Security-Policy: referrer origin;

<meta name="referrer" content="origin">

<a href="http://example.com" referrer="origin">

Page 77: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

(initial implementations)

Page 78: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

HTTPS

Page 79: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

if you're not using it, now is the time to start :)

Page 81: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 82: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

mass surveillance ofall Internet traffic

is no longer theoretical

Page 83: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

strong encryption ofall Internet traffic

is no longer optional

Page 84: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption in a country, that country's authorities have an easy way of identifying them. But if everyone uses it all of the time, encryption ceases to be a signal. The government can't tell the dissidents from the rest of the population. Every time you use encryption, you're protecting someone who needs to use it to stay alive.”

-Bruce Schneier

Page 87: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

$ apt-get install letsencrypt

$ letsencrypt example.com

Page 88: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

automatically prove domain ownership

download a free-as-in-beer certificate

monitor and renew it before it expires

Page 89: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

automatically prove domain ownership

download a free-as-in-beer certificate

monitor and renew it before it expires

Page 90: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

automatically prove domain ownership

download a free-as-in-beer certificate

monitor and renew it before it expires

Page 91: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

HTTPS is not enough

you need to do it properly

Page 92: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

RC4

Page 93: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

SHA-1

RC4

Page 94: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

SHA-11024-bit certificates

RC4

Page 95: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

SHA-11024-bit certificates

RC4 weak DH parameters

Page 100: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

https://people.mozilla.org/~fmarier/mixed-content.html

<html><head> <script src="http://people.mozilla.org/~fmarier/mixed-content.js"> </script></head><body> <img src="http://fmarier.org/img/francois_marier.jpg"></body></html>

Page 101: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption
Page 102: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

turn on full mixed-content blocking in development

Page 103: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Start by enabling HTTPS and HSTS

Use SRI for your external scripts

Set a more restrictive Referrer policy

Consider enabling CSP

Watch out for mixed content

Page 104: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

Questions?feedback:

[email protected]@w3.org

© 2015 François Marier <[email protected]>This work is licensed under aCreative Commons Attribution-ShareAlike 4.0 License.

Page 105: Security and Privacy on the Web in 2015“If we only use encryption when we're working with important data, then encryption signals that data's importance. If only dissidents use encryption

photo credits:

tinfoil: https://www.flickr.com/photos/laurelrusswurm/15129449047

explosion: https://www.flickr.com/photos/-cavin-/2313239884/

snowden: https://www.flickr.com/photos/gageskidmore/16526354372