Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Platform Security @ CMS Security Summit

3c27881a0d8695811b0fa23bd794e696?s=47 Mike West
January 30, 2019
Programming
0
51

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.

3c27881a0d8695811b0fa23bd794e696?s=128

Mike West

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
55
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
84
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
1.1k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
1
42
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
300
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
530
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
0
230
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
5
1.3k
3c27881a0d8695811b0fa23bd794e696?s=48 mikewest
2
940

Other Decks in Programming

See All in Programming
Bbb17eeeecd3d9d06f4db310ab630a12?s=48 borkdude
2
210
7867fe52a9be4257508a516d4df61578?s=48 tkmnzm
0
120
3187acdb47cb44678ad716c3228bf91b?s=48 keeeeen
0
110
15934fa2aa7b2ce21f091e9b7cffa856?s=48 manfredsteyer
PRO
0
110
Eeedbe91225c0207014a46f09eea1d30?s=48 nearmugi
0
190
127f2573f14072eba29ccb60506663eb?s=48 madai0517
1
200
Dcbf2269af2483cabf43128ad1718c11?s=48 grapecity_dev
0
180
C5c09bfd9ee31f5aef8ce257643d50ea?s=48 takapy
0
160
Dcbf2269af2483cabf43128ad1718c11?s=48 grapecity_dev
0
180
Dcbf2269af2483cabf43128ad1718c11?s=48 grapecity_dev
0
190
6c366ab6293eb42aec0e6f5f69b50882?s=48 ryokbt
2
300
Cc8ec9594b83b5dc3c7eef345c05dc8d?s=48 shiz
1
100

Featured

See All Featured
78b475797a14c84799063c7cd073962f?s=48 holman
461
280k
C157b16234f1e75e8eac3698c1d4414a?s=48 ddemaree
273
31k
168ccec72eee0530b818d44f3fedaacf?s=48 shlominoach
176
7.5k
A60068bce2e73de3a37ca9d2dbe36092?s=48 bryan
31
3.4k
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
117
4.9k
24fc194843a71f10949be18d5a692682?s=48 gr2m
83
11k
Ae14cc4491ac334f9cd23f9f93b4305e?s=48 orderedlist
PRO
328
36k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
401
20k
462dad0dd24c568a32dcdb0ae895ae1b?s=48 rasmusluckow
318
18k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
294
39k
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
8
550
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
359
62k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, mkwst@google.com, @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West mkwst@google.com

    @mikewest