HTML5 Security

SECURITY<!doctype html>

Ville Säävuori · · OWASP Helsinki · 15.6.2011

beyond the attack vectors

I AM NOT A SECURITY EXPERT(But a Web Developer :)

<!doctype html>

html

• API Metering

• Backups & Snapshots

• Counters

• Cloud/Cluster Management Tools

• Instrumentation/Monitoring

• Failover

• Node addition/removal and hashing

• Auto-scaling for cloud resources

• CSRF/XSS Protection

• Data Retention/Archival

• Deployment Tools

• Multiple Devs, Staging, Prod

• Data model upgrades

• Rolling deployments

• Multiple versions (selective beta)

• Bucket Testing

• Rollbacks

• CDN Management

• Distributed File Storage

• Distributed Log storage, analysis

• Graphing

• HTTP Caching

• Input/Output Filtering

• Memory Caching

• Non-relational Key Stores

• Rate Limiting

• Relational Storage

• Queues

• Rate Limiting

• Real-time messaging (XMPP)

• Search

• Ranging

• Geo

• Sharding

• Smart Caching

• Dirty-table management

http://randomfoo.net/2009/01/28/infrastructure-for-modern-web-sites

complex

http://www.flickr.com/photos/stuckincustoms/5069047950/

what is it?

Markup likeGuido

intended it.

Markup likeGuido Tim

intended it.

Not Just Markup

anymore.

security

<audio> <video>

<footer>

<header>

<canvas>

<audio>

<audio src='foo.mp4'

preload='auto'>

<input type='email' required pattern='.*@syneus\.fi'>

HTTP/1.1 200 OKDate: Wed, 15 Jun 2011 17:45:00 GMTServer: Nginx/1.0.4Access-Control-Allow-Origin: http://syneus.fi

local storagelocalStorage.setItem('name', 'Hello World!');

Web Forms 2.0

SVG

CSS3div > p:last-of-type { ... }

GeoLocationnavigator.geolocation.getCurrentPosition(show_map);

<iframe sandbox="allow-scripts">

in the wild

http://www.flickr.com/photos/sharkbait/2992242065/

http://www.flickr.com/photos/rainbirder/5068808204/

common issues

XSShttp://www.flickr.com/photos/rainbirder/5068808204/

XSRFhttp://www.flickr.com/photos/rainbirder/5068808204/

SQL Injectionhttp://www.flickr.com/photos/rainbirder/5068808204/

Clickjackinghttp://www.flickr.com/photos/rainbirder/5068808204/

ways to protect

http://www.flickr.com/photos/soldiersmediacenter/5285447846/

understand threats


understand threats


no, really.

sanitation


test your code


test your code


regularly.

test your code


often.

stay updated


The answers to your Security Questions are case sensitive and cannot contain special characters like an apostrophe,

or the words “insert,” “delete,” “drop,” “update,” “null,” or “select.”

— Sacramento Credit Union

?

http://www.flickr.com/photos/remydwd/48898192/

http://www.flickr.com/photos/amagill/51806161/

Best practices

trust no one

http://www.flickr.com/photos/furryscalyman/673915993/

use good toolsLet frameworks help you.

but don’t trust them blindlyAgain. Understand what you’re doing.

use secure protocols

HTTPS over HTTP

outsource

hire someone

use a checklist

or

but at least

understand your users

Mere mortals don’t behave like nerds.

educate themWhy is it important to have a good password?

www.syneus.fi/aiheet/html5

html5sec.org

lyh.fi/web_security

MORE

http://www.syneus.fi/aiheet/html5/


http://html5sec.org/


http://lyh.fi/web_security




Kiitos!Ville Säävuori

@uninen

www.syneus.fi/aiheet/html5

html5sec.org

lyh.fi/web_security

MORE









Technology

HTML5 Security