I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.
We are thinking about migrating to HTML 5, are there any security advantages in doing such a thing?
The risks of Flash are client side. When viewing an compromised site that is well designed (not susceptible to XSS), there should be no difference in security between Flash and HTML 5 since the content is not malware. The main security problem with flash is for the client. When they visit a site infected with Flash based malware, bad things can happen to their computer. It isn't a server side concern.
Security advantages on the server side, or client side?
For serverside (hacking the server - getting access to the server files) I don't see any advantages to do either one or the other. They are both files that do nothing. If you use PHP or another serverside language, that may cause problems, but then it's PHP, not Flash or HTML5.
On the client side, Flash is known to have vulnerabilities and it's used quite often to attack a client computer. It does not really matter if your sites use Flash or not. It does matter if the client has flash installed, but that's not your responsibility.
If a visitor has no Flash installed and is forced to install Flash because of your website, and then visits another site that has a mallware flash banner, then he might get infected. Is that your fault?
Let's assume your webserver is not hacked, so there are no files that will infect a client computer on your server.
I know of a few security advantages that HTML 5 has when compared to flash and one disadvantage,this answer may not be complete
-HTML 5 updates are delivered through browsers hence there is a greater chance of users updating to the latest patch(as opposed to flash's 3rd party plugins that require separate updates)
-i believe that HTML 5 access to system resources is more restricted than that of flash(will have to confirm this one, i will update this point if needed after further research)
-A large group of companies(facebook,apple,google etc) have pledged their support to HTML5 and hence a lot of research will happen on the security aspects from multiple companies
I believe(not extremely sure) that a major security disadvantage of HTML5 is that an attacker can easily view the source code of a game as opposed to flash where the attacker will have to crack the swf file.(i have not done that before so i do not know how easy is it to do so)I will update this point too, if needed after further research
Apart from comparing html5 security to flash, there is a whole set of new features with html5(for eg cross domain access,offline storage) that can make it more vulnerable than regular html, but that can be another question.