Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Platform Security @ CMS Security Summit

3c27881a0d8695811b0fa23bd794e696?s=47 Mike West
PRO
January 30, 2019
Programming
0
67

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.

3c27881a0d8695811b0fa23bd794e696?s=128

Mike West
PRO

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
Isolation by Default
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
0
1.1k
The Web We Can Ship
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
0
210
Web Platform Security @ CMS Security Summit 2020
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
0
1.6k
Web Platform Security @ TechDays 2019
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
1
100
Cookies are bad @ HTTP Workshop 2019
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
0
350
Web Platform Security PhD Summit @ Google Munich
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
2
650
BSides Munich
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
0
250
Hardening the Web Platform - AppSec EU, 2016
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
5
1.3k
Web Platform Security (dotSecurity, April 2016)
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
PRO
2
1k

Other Decks in Programming

See All in Programming
engineer
E6706306bf41c5a5675e7296ecdb4103?s=48 spacemarket
0
3.8k
Client-Side Field-Level Encryption for Apache Kafka Connect @ VoxxedDays Luxembourg 2022
744f1c2c6cbea2ff5104b0ac512936bd?s=48 hpgrahsl
0
120
Gitlab CIでMRを自動生成する
1a2f29252240936c0ac4db4edab36d41?s=48 forcia_dev_pr
0
120
"What's new in Swift"の要約 / swift_5_7_summary
42a6a049ac8f5265f31858a9509217fb?s=48 uhooi
1
340
Independently together: 
better developer experience & App performance
80d92d5d0bd0170aebf6e07589a0b571?s=48 bcinarli
0
180
「混ぜるな危険」を推進する設計
8ec2b967e38f000eb63ae345cd7c58e6?s=48 minodriven
8
2.1k
Angular-basierte Micro Frontends mit Module Federation @API Summit
15934fa2aa7b2ce21f091e9b7cffa856?s=48 manfredsteyer
PRO
0
110
io22 extended What's new in app performance
82aa6e293e94bf37796f4ae50f583f6c?s=48 veronikapj
0
350
Meet Swift Regex
0b26590a0a8b0f1da140ed5de9b68379?s=48 usamik26
0
370
Let's keep Commodore 64 alive for the next 40 years
85977ebfe59c2ee669f2196930f1a701?s=48 mehowte
1
110
[월간 데이터리안 세미나 6월] 스스로 성장하는 분석가 커리어 이야기
Fc03caed2b0f2a29992487fcf50dfd81?s=48 datarian
0
240
Baseline Profilesでアプリのパフォーマンスを向上させる / Improve app performance with Baseline Profiles
37618b4d60cf3d1f43f7196253264edc?s=48 numeroanddev
0
250

Featured

See All Featured
The MySQL Ecosystem @ GitHub 2015
Be9caeb9d4ef9944d151af909063ed6e?s=48 samlambert
238
11k
KATA
E9221b172e78e888355fa2fe4541b595?s=48 mclloyd
7
8.7k
How to name files
0a4f62e90c976eeb44d33add75cca5af?s=48 jennybc
40
61k
No one is an island. Learnings from fostering a developers community.
6bb82b13cda86d3b821fa44100335ddf?s=48 thoeni
9
1.3k
What's new in Ruby 2.0
7edec06b5435e0dac07a353b2cc26253?s=48 geeforr
336
30k
Building Flexible Design Systems
91cefdf141106fa10674aae74ce05890?s=48 yeseniaperezcruz
310
34k
Bootstrapping a Software Product
A9179349dd2bdc67f377719f56d85656?s=48 garrettdimon
296
110k
Navigating Team Friction
245cee81a9c424266e5e401d844ea881?s=48 lara
175
11k
The Invisible Customer
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
110
11k
How to Ace a Technical Interview
2f5463832ccb768ccb4a1ca3607c27ef?s=48 jacobian
265
21k
CSS Pre-Processors: Stylus, Less & Sass
7559f6cff1f5efc2d210965febd4d71c?s=48 bermonpainter
349
27k
10 Git Anti Patterns You Should be Aware of
Dafc4723e9a1c067796c0fec6f509774?s=48 lemiorhan
638
52k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, mkwst@google.com, @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West mkwst@google.com

    @mikewest