Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Platform Security @ CMS Security Summit

3c27881a0d8695811b0fa23bd794e696?s=47 Mike West
January 30, 2019
Programming
0
53

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.

3c27881a0d8695811b0fa23bd794e696?s=128

Mike West

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
490
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
97
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
1.1k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
78
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
320
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
540
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
230
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
5
1.3k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
940

Other Decks in Programming

See All in Programming
8ec2b967e38f000eb63ae345cd7c58e6?s=48 minodriven
40
30k
7975b9fd58c8945ae1c6b38747de7f28?s=48 line_developers_tw2
0
260
63c01564f6afe7af88d5d6981790457d?s=48 shomatan
0
240
4047c64e3a1e2f81addd4ba675ddc451?s=48 zsmb
0
130
5d769d109697012317c09c6a27a6a4bf?s=48 linyows
0
330
C951afc0782b7d3d4800e25b4a4938a9?s=48 shinnoki
0
1.4k
827c50b8ee8994d5feac521f09178d0e?s=48 karosuwindam
0
140
8673a339e4002704b42bc66c43c65445?s=48 scrpgil
0
130
1a517fb4f2fe1ad4c6bbfc0cbb17ba10?s=48 kasai441
0
240
Bf3b070c18a5c2d86d5be65d31241e5c?s=48 kota_yata
8
4.1k
15934fa2aa7b2ce21f091e9b7cffa856?s=48 manfredsteyer
PRO
0
130
7b606c5039f083d13e2d2320ce6ddcfa?s=48 dqneo
0
170

Featured

See All Featured
Bfd6b681ec6e8c9bef82ff0521c364f7?s=48 kastner
54
2k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
220
15k
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
360
62k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
370
42k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
498
130k
B47b288784fda77a94aeb234ca743c24?s=48 keavy
108
14k
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
612
55k
15f2b8221f247985a27a627d2ece72f0?s=48 pauljervisheath
195
15k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
779
240k
Dad095ea7038f89f760419ce475d5d14?s=48 michaelherold
226
8.7k
1b8ad785acdd1ce1c99914b1c2a4e10e?s=48 sugarenia
233
890k
465724d73fe3a92c0879fdfb43a3a6f3?s=48 philhawksworth
193
8.9k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, mkwst@google.com, @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West mkwst@google.com

    @mikewest