Web Platform Security @ CMS Security Summit

3c27881a0d8695811b0fa23bd794e696?s=47 Mike West
January 30, 2019
Programming
0
50

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.

3c27881a0d8695811b0fa23bd794e696?s=128

Mike West

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
62
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
930
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
39
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
290
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
510
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
220
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
5
1.3k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
930
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
150

Other Decks in Programming

See All in Programming
2102a6b8760bd6f57f672805723dd83a?s=48 line_developers_tw
0
3.9k
3cfad86677c5966ecfe9b81955fa3489?s=48 youkan2002
0
220
9f33218af7ae5c04e102fcc3076f2f5c?s=48 yhkaplan
1
370
Bf5ee9059859ed5d855b5ff4680e63e2?s=48 track3jyo
4
770
D56734cc97be195e1356167167eb4b44?s=48 kaorumitsumori
1
230
6dd0483f1353a4a359e92633cfd65c64?s=48 wasabeef
27
6.2k
70adfe7679427fa498899769e632b672?s=48 itok
1
320
4861686276b2f990387eaef28b099db0?s=48 niyarin
1
370
A2407c5cea2c38ce15d85a5df9da820a?s=48 fumiyakume
0
550
Beb422437c1dfb5366f197919e41ac50?s=48 lilobase
1
370
894a9f3c8db89d0a5cd8e1add1dbe37b?s=48 usamiuhuru
0
400
C0eb1445cda9489ebf8c31c367fec3fb?s=48 exoego
1
380

Featured

See All Featured
5ce91fa49a613cbc3e20d5f96856473f?s=48 edds
55
9.3k
A9704266587836f7e784235e5073b93e?s=48 jmmastey
5
380
C35e01544a0dd94a2cf1619ee8a42ebb?s=48 clairelew
13
1.3k
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
115
4.7k
7edec06b5435e0dac07a353b2cc26253?s=48 geeforr
331
29k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
145
19k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
682
180k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
218
14k
95d9f37115fbb0d13135d0f77132f856?s=48 morganepeng
11
720
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
166
6.9k
3d4519fd34b76fb265fc0237f3792bd4?s=48 danielanewman
1
360
24fc194843a71f10949be18d5a692682?s=48 gr2m
82
11k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, mkwst@google.com, @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West mkwst@google.com

    @mikewest