Slide 1
Slide 1 text
Security and Privacy
on the Web in 2015
François Marier @fmarier
mozilla
Slide 2
Slide 2 text
Firefox
Security & Privacy
Slide 3
Slide 3 text
Web Platform
Slide 4
Slide 4 text
Web Platform
Slide 5
Slide 5 text
Content Security Policy
aka CSP
Slide 6
Slide 6 text
Content Security Policy
aka CSP
mechanism for preventing XSS
Slide 7
Slide 7 text
telling the browser what external
content is allowed to load
Slide 8
Slide 8 text
Hi you
alert('p0wned');
!
Tweet!
What's on your mind?
Slide 9
Slide 9 text
without CSP
Slide 10
Slide 10 text
Hi you!
John Doe - just moments ago
p0wned
Ok
Slide 11
Slide 11 text
with CSP
Slide 12
Slide 12 text
Hi you!
John Doe - just moments ago
Slide 13
Slide 13 text
Content-Security-Policy:
script-src 'self'
https://cdn.example.com
Slide 14
Slide 14 text
inline scripts are blocked unless
unsafe-inline is specified
Slide 15
Slide 15 text
script-src
object-src
style-src
img-src
media-src
frame-src
font-src
connect-src
Slide 16
Slide 16 text
$ curl --head https://twitter.com
HTTP/1.1 200 OK
content-length: 58347
content-security-policy: …
report-uri https://twitter.com/csp_report
violation reports:
Slide 17
Slide 17 text
"csp-report": {
"document-uri":
"http://example.org/page.html",
"referrer":
"http://evil.example.com/haxor.html",
"blocked-uri":
"http://evil.example.com/image.png",
"violated-directive": "default-src 'self'",
"effective-directive": "img-src",
"original-policy":
"default-src 'self';
report-uri http://example.org/..."
}
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
support for inline scripts
Content-Security-Policy:
script-src 'sha256-YWIzOW...'
Slide 20
Slide 20 text
No content
Slide 21
Slide 21 text
Strict Transport Security
aka HSTS
Slide 22
Slide 22 text
Strict Transport Security
aka HSTS
mechanism for preventing
HTTPS to HTTP downgrades
Slide 23
Slide 23 text
telling the browser that your site
should never be reached over HTTP
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
GET banque.fr 301
→
GET https://banque.fr 200
→
no HSTS, no sslstrip
Slide 26
Slide 26 text
GET banque.fr → 200
no HSTS, with sslstrip
Slide 27
Slide 27 text
what does HSTS look like?
Slide 28
Slide 28 text
$ curl -i https://example.com
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Strict-Transport-Security: max-age=31536000
...
Slide 29
Slide 29 text
with HSTS, with sslstrip
GET https://banque.fr 200
→
Slide 30
Slide 30 text
silent client-side redirects
HTTP → HTTPS
Slide 31
Slide 31 text
no HTTP traffic for
sslstrip to tamper with
Slide 32
Slide 32 text
except for the very
first connection
Slide 33
Slide 33 text
https://hstspreload.appspot.com/
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
coming up in 2015
Slide 36
Slide 36 text
No content
Slide 37
Slide 37 text
No content
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
https://ajax.googleapis.com
/ajax/libs/jquery/1.8.0/
jquery.min.js
Slide 40
Slide 40 text
how common is this?
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
what would happen if that
server were compromised?
Slide 43
Slide 43 text
No content
Slide 44
Slide 44 text
Bad Things™
steal sessions
leak confidential data
redirect to phishing sites
enlist DDoS zombies
Slide 45
Slide 45 text
simple solution
Slide 46
Slide 46 text
instead of this:
Slide 47
Slide 47 text
do this:
Slide 48
Slide 48 text
guarantee:
script won't change
or it'll be blocked
Slide 49
Slide 49 text
limitation:
won't work for scripts
that change all the time
Slide 50
Slide 50 text
https://ajax.googleapis.com
/ajax/libs/jquery/1.8.0/
jquery.min.js
Slide 51
Slide 51 text
there's a little something missing...
Slide 52
Slide 52 text
complete example:
Slide 53
Slide 53 text
No content
Slide 54
Slide 54 text
“a web browser permits scripts contained in a first
web page to access data in a second web page,
but only if both web pages have the same origin”
same-origin policy
Slide 55
Slide 55 text
example.com/index.html
Slide 56
Slide 56 text
example.com/index.html
example.com/data.js:
var secret = 42;
Slide 57
Slide 57 text
example.com/index.html
example.com/data.js:
var secret = 42;
evil.net/widget.js:
exfiltrate(secret);
Slide 58
Slide 58 text
example.com/index.html
example.com/data.js:
var secret = 42;
evil.net/widget.js:
exfiltrate(secret);
Slide 59
Slide 59 text
on the server:
Access-Control-Allow-Origin: *
Slide 60
Slide 60 text
on the server:
Access-Control-Allow-Origin: *
on the client:
crossorigin=”anonymous”
Slide 61
Slide 61 text
complete example:
Slide 62
Slide 62 text
complete example:
Slide 63
Slide 63 text
SRIhash.org
Slide 64
Slide 64 text
No content
Slide 65
Slide 65 text
No content
Slide 66
Slide 66 text
No content
Slide 67
Slide 67 text
http://example.com/search?q=serious+medical+condition
Click here for
the cheapest
insurance
around!
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla. Bla bla bla, bla
bla, bla bla bla bla. Bla bla bla, bla bla, bla bla bla bla.
Bla bla bla, bla bla, bla bla bla bla.
Slide 68
Slide 68 text
No content
Slide 69
Slide 69 text
No Referrer
No Referrer When Downgrade
Origin Only
Origin When Cross Origin
Unsafe URL
Slide 70
Slide 70 text
No Referrer
No Referrer When Downgrade
Origin Only
Origin When Cross Origin
Unsafe URL
Slide 71
Slide 71 text
No Referrer
No Referrer When Downgrade
Origin Only
Origin When Cross Origin
Unsafe URL
Slide 72
Slide 72 text
No Referrer
No Referrer When Downgrade
Origin Only
Origin When Cross Origin
Unsafe URL
Slide 73
Slide 73 text
No Referrer
No Referrer When Downgrade
Origin Only
Origin When Cross Origin
Unsafe URL
Slide 77
Slide 77 text
(initial implementations)
Slide 78
Slide 78 text
HTTPS
Slide 79
Slide 79 text
if you're not using it, now is the time to start :)
Slide 80
Slide 80 text
No content
Slide 81
Slide 81 text
No content
Slide 82
Slide 82 text
mass surveillance of
all Internet traffic
is no longer theoretical
Slide 83
Slide 83 text
strong encryption of
all Internet traffic
is no longer optional
Slide 84
Slide 84 text
“If we only use encryption when we're working with
important data, then encryption signals that data's
importance. If only dissidents use encryption in a
country, that country's authorities have an easy way of
identifying them. But if everyone uses it all of the time,
encryption ceases to be a signal. The government can't
tell the dissidents from the rest of the population. Every
time you use encryption, you're protecting someone
who needs to use it to stay alive.”
-Bruce Schneier
Slide 85
Slide 85 text
ps://gigaom.com/2015/02/19/dont-let-att-mislead-you-about-its-29-privacy-fee/
Slide 86
Slide 86 text
No content
Slide 87
Slide 87 text
$ apt-get install letsencrypt
$ letsencrypt example.com
Slide 88
Slide 88 text
automatically prove domain ownership
download a free-as-in-beer certificate
monitor and renew it before it expires
Slide 89
Slide 89 text
automatically prove domain ownership
download a free-as-in-beer certificate
monitor and renew it before it expires
Slide 90
Slide 90 text
automatically prove domain ownership
download a free-as-in-beer certificate
monitor and renew it before it expires
Slide 91
Slide 91 text
HTTPS is not enough
you need to do it properly
Slide 92
Slide 92 text
RC4
Slide 93
Slide 93 text
SHA-1
RC4
Slide 94
Slide 94 text
SHA-1
1024-bit certificates
RC4
Slide 95
Slide 95 text
SHA-1
1024-bit certificates
RC4 weak DH parameters
Slide 96
Slide 96 text
No content
Slide 97
Slide 97 text
No content
Slide 98
Slide 98 text
No content
Slide 99
Slide 99 text
No content
Slide 100
Slide 100 text
https://people.mozilla.org/~fmarier/mixed-content.html
Slide 101
Slide 101 text
No content
Slide 102
Slide 102 text
turn on full mixed-content blocking in development
Slide 103
Slide 103 text
Start by enabling HTTPS and HSTS
Use SRI for your external scripts
Set a more restrictive Referrer policy
Consider enabling CSP
Watch out for mixed content
Slide 104
Slide 104 text
Questions?
feedback:
[email protected]
mozilla.dev.security
[email protected]
© 2015 François Marier
This work is licensed under a
Creative Commons Attribution-ShareAlike 4.0 License.
Slide 105
Slide 105 text
photo credits:
tinfoil: https://www.flickr.com/photos/laurelrusswurm/15129449047
explosion: https://www.flickr.com/photos/-cavin-/2313239884/
snowden: https://www.flickr.com/photos/gageskidmore/16526354372