I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.
We are thinking about migrating to HTML 5, are there any security advantages in doing such a thing?
The risks of Flash are client side. When viewing an compromised site that is well designed (not susceptible to XSS), there should be no difference in security between Flash and HTML 5 since the content is not malware. The main security problem with flash is for the client. When they visit a site infected with Flash based malware, bad things can happen to their computer. It isn't a server side concern.
Security advantages on the server side, or client side?
For serverside (hacking the server - getting access to the server files) I don't see any advantages to do either one or the other. They are both files that do nothing. If you use PHP or another serverside language, that may cause problems, but then it's PHP, not Flash or HTML5.
On the client side, Flash is known to have vulnerabilities and it's used quite often to attack a client computer. It does not really matter if your sites use Flash or not. It does matter if the client has flash installed, but that's not your responsibility.
If a visitor has no Flash installed and is forced to install Flash because of your website, and then visits another site that has a mallware flash banner, then he might get infected. Is that your fault?
Let's assume your webserver is not hacked, so there are no files that will infect a client computer on your server.
I know of a few security advantages that HTML 5 has when compared to flash and one disadvantage,this answer may not be complete
-HTML 5 updates are delivered through browsers hence there is a greater chance of users updating to the latest patch(as opposed to flash's 3rd party plugins that require separate updates)
-i believe that HTML 5 access to system resources is more restricted than that of flash(will have to confirm this one, i will update this point if needed after further research)
-A large group of companies(facebook,apple,google etc) have pledged their support to HTML5 and hence a lot of research will happen on the security aspects from multiple companies
I believe(not extremely sure) that a major security disadvantage of HTML5 is that an attacker can easily view the source code of a game as opposed to flash where the attacker will have to crack the swf file.(i have not done that before so i do not know how easy is it to do so)I will update this point too, if needed after further research
Apart from comparing html5 security to flash, there is a whole set of new features with html5(for eg cross domain access,offline storage) that can make it more vulnerable than regular html, but that can be another question.
There's a few deadly exploits employed by HTML5 that can't be patched, except by the browser itself. The bad thing about patching things like this is that it eliminates functionality as a whole. Things web devs found useful are now restricted because someone abused it.
Flash only needs block "strings" in their patching, allowing useful function to remain. Adobe was simply lazy about updates and patches etc.. as a language, AS3 is superior and it uses less battery than HTML5
HTML5 is proving to be quite dangerous, although it runs so well (same effects as flash via the canvas) old browsers in dated OS's are able to view it. I hear Mac OS9 is reviving thanks to HTML5, there's even reports of Win 3.1 displaying HTML5 content at full speed. Interesting... if only old machines could improve hardware wise, or at least let us install older OS on raspberry pi's