ʕ•ᴥ•ʔ
!
• Don’t do it (leave it to GitHub, Google, etc.)
• If you must do it, use pbkdf2 or bcrypt or scrypt.
• Keep password length between 8 and 50.
• Nothing can save you easy to guess passwords.
Slide 51
Slide 51 text
Cross Site Scripting - XSS
Slide 52
Slide 52 text
1993
Slide 53
Slide 53 text
Slide 54
Slide 54 text
!
Slide 55
Slide 55 text
Web Security 101
Slide 56
Slide 56 text
No content
Slide 57
Slide 57 text
?
Slide 58
Slide 58 text
Escaping
Slide 59
Slide 59 text
Angle brackets: > <
Slide 60
Slide 60 text
No content
Slide 61
Slide 61 text
1995
Slide 62
Slide 62 text
JavaScript
Slide 63
Slide 63 text
!
Slide 64
Slide 64 text
Slide 65
Slide 65 text
var message = "Web Security 101";
!
alert(message);
Slide 66
Slide 66 text
No content
Slide 67
Slide 67 text
var message = "<b>Web Security 101</b>";
!
document.write(message);
Slide 68
Slide 68 text
No content
Slide 69
Slide 69 text
JavaScript == DANGER
Slide 70
Slide 70 text
No content
Slide 71
Slide 71 text
“Samy is my hero” (2005)
• XSS attack propagated
by Myspace profiles.
!
• Over one million affected
users within the first 20
hours.
!
• 3 years without computer.