Browsers: Reloaded - A Look at Next Generation Web Browsers

•

1 gostou•516 visualizações

There are a bunch of new "web browsers" hitting the market; some of them even claim to be more "secure"... but are they? What's preventing security from happening.

Tecnologia

Browsers: Reloaded
Rafal M. Los
Web Application Security SME
Hewlett-Packard Application Security Center
May 18th, 2009

In the future, the battle for
control of your online
computing experience will be
fought in your browser.

Overloaded, Overworked, Broken

Browser “extensibility” is duct tape & bubble gum

Consider how many
plug-ins most browsers have-

What Do Consumers Want?

1 st Functionality.

Then Security made simple.
(maybe)

Why is this so hard?

Why Can’t It Just Work?

Functional Secure
•“neat” tech •“trusted” tech
•Interoperable •Minimalistic
•Interactive approach
•Extensible

Is middle ground just
failure for both?

Usable Security
Users want security features they don’t need to
“think” about
– “It should just be secure without my help”
– Make “security decisions” without compromising
the browsing experience
– Protect the user from him/herself
– … is this even possible?

Example: Why NoScript Fails
NoScript is security via “plug in”
– Fails because
• Blocks all script by default
• Breaks functionality for the user
• Requires the user to make security decisions!
– Most common users simply “enable all JS”…
• …and are back to square 1
– How many regular users do you know use
NoScript?

FireFox? IE? Safari? Chrome?
With all these options, how is a person to
choose the right one?
While every browser claims to be “more secure”,
what does that mean?
Is there a legitimate reason for your browser to
have a task manager?

Example: Chrome’s Tabs

Should your sessions persist across multiple tabs?
Windows?

Example: Chrome’s Tabs

What do you suppose is the result?

Browser Wish List
• Browser framework itself resilient to attack
– One window/tab can’t crash another?
• Reduced attack surface for plug-ins
– Limit how much damage a plug-in can do
• No session persistence across windows/tabs
– Why does this even exist today?
• Basic security features?
– Provide basic defense against client-side attacks

Are Modern Browsers Secure?

No.

Internet Explorer, FireFox, Chrome, Safari

… all have the same basic flaws.

Rafal Los
HP Application Security Center

Email: Rafal@HP.com
Direct: (404) 606-6056
Twitter: RafalLos
Blog:
http://www.communities.hp.com/securitysoftware/blogs/rafal

Mais conteúdo relacionado

Destaque

Gerencia de proyectos mapa conceptualAna Cristina

Mapa conceptual campos de la psicologíaesperanzasimon

Mapa Gerencia ProyectosEdgar Gutiérrez

Pay just 1.5 Lac and own your dream home.Dr Nishit Ambalia

Mapa conceptual gerencia de proyectos educativosGloria Marlen Siatoya Ramirez

U.S. Military Armored Vehicle, Tank, And Tank Component Market. Analysis And ...IndexBox Marketing

PORTFOLIO IN EDUCATIONAL TECHNOLOGY 1 & 2catubigcatherine

Destaque (7)

Gerencia de proyectos mapa conceptual

Mapa conceptual campos de la psicología

Mapa Gerencia Proyectos

Pay just 1.5 Lac and own your dream home.

Mapa conceptual gerencia de proyectos educativos

U.S. Military Armored Vehicle, Tank, And Tank Component Market. Analysis And ...

PORTFOLIO IN EDUCATIONAL TECHNOLOGY 1 & 2

Mais de Rafal Los

The 5 Ps of Preparedness - Hope is Not a Strategy [1].pdfRafal Los

Irrational But Effective - Applying Parenthood Lessons to Cyber SecurityRafal Los

SAINTCON 21 - Of Sandcastles and Luck (Fixing Vulnerability Management)Rafal Los

Strategies and Tactics for Effectively Managing Vulnerabilities in Diverse En...Rafal Los

Lies, Fables and Security MetricsRafal Los

Losing battles, winning warsRafal Los

5 Things CFOs Need to Know About Enterprise Security - HP CFO Summit 2013Rafal Los

Operationalizing Security Intelligence [ InfoSec World 2014 ]Rafal Los

Operationalizing security intelligence for the mid market - Rafal Los - RSA C...Rafal Los

Rebooting the Enterprise Security Program for Defensibility - ISSA Internatio...Rafal Los

Cloud Security Alliance- Challanges of an elastic environment v8a [public]Rafal Los

Threat modeling the security of the enterpriseRafal Los

Making Measurable Gains - Contextualizing 'Secure' in BusinessRafal Los

Security BSides Atlanta - "The Business Doesn't Care..."Rafal Los

Software Security Assurance - Program Building (You're going to need a bigger...Rafal Los

The Future of Software Security AssuranceRafal Los

Defying Logic - Business Logic Testing with AutomationRafal Los

Ultimate Hack! Layers 8 & 9 of the OSI ModelRafal Los

Into the Rabbithole - Evolved Web App Security Testing (OWASP AppSec DC)Rafal Los

Oh No They Didn't! 7 Web App Security Stories (v1.0)Rafal Los

Mais de Rafal Los (20)

The 5 Ps of Preparedness - Hope is Not a Strategy [1].pdf

Irrational But Effective - Applying Parenthood Lessons to Cyber Security

SAINTCON 21 - Of Sandcastles and Luck (Fixing Vulnerability Management)

Strategies and Tactics for Effectively Managing Vulnerabilities in Diverse En...

Lies, Fables and Security Metrics

Losing battles, winning wars

5 Things CFOs Need to Know About Enterprise Security - HP CFO Summit 2013

Operationalizing Security Intelligence [ InfoSec World 2014 ]

Operationalizing security intelligence for the mid market - Rafal Los - RSA C...

Rebooting the Enterprise Security Program for Defensibility - ISSA Internatio...

Cloud Security Alliance- Challanges of an elastic environment v8a [public]

Threat modeling the security of the enterprise

Making Measurable Gains - Contextualizing 'Secure' in Business

Security BSides Atlanta - "The Business Doesn't Care..."

Software Security Assurance - Program Building (You're going to need a bigger...

The Future of Software Security Assurance

Defying Logic - Business Logic Testing with Automation

Ultimate Hack! Layers 8 & 9 of the OSI Model

Into the Rabbithole - Evolved Web App Security Testing (OWASP AppSec DC)

Oh No They Didn't! 7 Web App Security Stories (v1.0)

Último

Gen AI in Business - Global Trends Report 2024.pdfAddepto

Generative AI for Technical Writer or Information DevelopersRaghuram Pandurangan

"ML in Production",Oleksandr BaganFwdays

Commit 2024 - Secret Management made easyAlfredo García Lavilla

TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc

TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey

The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3

DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy

Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed

A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB

WordPress Websites for Engineers: Elevate Your Brandgvaughan

Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University

From Family Reminiscence to Scholarly Archive .Alan Dix

DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell

Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation

Advanced Computer Architecture – An IntroductionDilum Bandara

Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity

Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3

Browsers: Reloaded - A Look at Next Generation Web Browsers

1. Browsers: Reloaded Rafal M. Los Web Application Security SME Hewlett-Packard Application Security Center May 18th, 2009

2. In the future, the battle for control of your online computing experience will be fought in your browser.

3. Overloaded, Overworked, Broken Browser “extensibility” is duct tape & bubble gum Consider how many plug-ins most browsers have-

4. What Do Consumers Want? 1 st Functionality. Then Security made simple. (maybe) Why is this so hard?

5. Why Can’t It Just Work? Functional Secure •“neat” tech •“trusted” tech •Interoperable •Minimalistic •Interactive approach •Extensible Is middle ground just failure for both?

6. Usable Security Users want security features they don’t need to “think” about – “It should just be secure without my help” – Make “security decisions” without compromising the browsing experience – Protect the user from him/herself – … is this even possible?

7. Example: Why NoScript Fails NoScript is security via “plug in” – Fails because • Blocks all script by default • Breaks functionality for the user • Requires the user to make security decisions! – Most common users simply “enable all JS”… • …and are back to square 1 – How many regular users do you know use NoScript?

8. FireFox? IE? Safari? Chrome? With all these options, how is a person to choose the right one? While every browser claims to be “more secure”, what does that mean? Is there a legitimate reason for your browser to have a task manager?

9. Example: Chrome’s Tabs Should your sessions persist across multiple tabs? Windows?

10. Example: Chrome’s Tabs What do you suppose is the result?

11. Example: Chrome’s Tabs

12. Browser Wish List • Browser framework itself resilient to attack – One window/tab can’t crash another? • Reduced attack surface for plug-ins – Limit how much damage a plug-in can do • No session persistence across windows/tabs – Why does this even exist today? • Basic security features? – Provide basic defense against client-side attacks

13. Are Modern Browsers Secure? No. Internet Explorer, FireFox, Chrome, Safari … all have the same basic flaws.

14. Rafal Los HP Application Security Center Email: Rafal@HP.com Direct: (404) 606-6056 Twitter: RafalLos Blog: http://www.communities.hp.com/securitysoftware/blogs/rafal

Browsers: Reloaded - A Look at Next Generation Web Browsers

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (7)

Mais de Rafal Los

Mais de Rafal Los (20)

Último

Último (20)

Browsers: Reloaded - A Look at Next Generation Web Browsers