Web Platform Security @ CMS Security Summit

3c27881a0d8695811b0fa23bd794e696?s=47 Mike West
January 30, 2019
Programming
0
46

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.

3c27881a0d8695811b0fa23bd794e696?s=128

Mike West

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
830
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
33
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
290
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
500
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
220
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
5
1.3k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
910
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
140
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
460

Other Decks in Programming

See All in Programming
E6143330e12cd226c3dab99f3fe8cb3e?s=48 yanaemon
1
150
D882856fd493248c73331872a516d1b5?s=48 exsoul
1
120
Fc96157614ee73039c4a575906167979?s=48 fukumura
0
260
018058d75600e02954f48b471765ae3a?s=48 yuki384
0
190
9fbbe5d0b8e2ee1cdc3a576b55a2d63d?s=48 uzimaru0000
0
240
Db2247a5b4226e1f6f74a9bd87810090?s=48 hiroakis
3
520
D360f2c7f29fa7e28e3e648031fbe2f3?s=48 kajyuuen
0
110
1d1580fb0945b0ffadff18e28bead3c5?s=48 adarapata
0
290
354271902cd8ba2762d05b251dfa0f84?s=48 pluu
0
280
3ed241740309c9b4adfeccc6212465b0?s=48 mfunaki
0
180
252e6c31a6452aa80deb9ad0107975c7?s=48 attakei
0
200
9af444e4e7110845f0b3319efb1ca252?s=48 920oj
1
680

Featured

See All Featured
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
407
57k
9128d500301ae51524e887bb680f471d?s=48 caitiem20
300
16k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
240
20k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
84
7.6k
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
323
14k
C157b16234f1e75e8eac3698c1d4414a?s=48 ddemaree
274
31k
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
2
39
Ba530e786553390f3fb271848485681c?s=48 3n
159
22k
E6c6e133e74c3b83f04d2861deaa1c20?s=48 searls
202
35k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
1348
190k
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
266
16k
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
104
10k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, mkwst@google.com, @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West mkwst@google.com

    @mikewest