Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.

We are thinking about migrating to HTML 5, are there any security advantages in doing such a thing?

share|improve this question
    
You may want to watch this talk by Robert McArdle at BSides London 2012 - "HTML5 - A Whole New Attack Vector". –  Deer Hunter Mar 22 '13 at 13:21
1  
Just checking... You're not doing anything that involves creating a login for the where Flash is handling the authentication, are you? I watched a video about six months ago that showed how simple it is to bypass that. Some web sites have flash content that's supposed to be "secure" and they used a Flash Login to protect it, but it's so easy to bypass that, you may as well not be bothering to provide a login at all. There's a blog post covering it here: blog.philippheckel.com/2011/03/01/… –  David Mar 22 '13 at 19:56

4 Answers 4

The risks of Flash are client side. When viewing an compromised site that is well designed (not susceptible to XSS), there should be no difference in security between Flash and HTML 5 since the content is not malware. The main security problem with flash is for the client. When they visit a site infected with Flash based malware, bad things can happen to their computer. It isn't a server side concern.

share|improve this answer
    
Also I would add that theoretically, Flash is dying (due to constant vulnerabilities) and HTML5 is rising. I'm hearing this for quite some time, but still I keep seeing Flash in use so... –  yzT Mar 22 '13 at 14:16
    
@yzT It is true that HTML5 is gaining on Flash, particularly since Flash stopped supporting Mobile platforms, but it doesn't really have anything do do with the safety (security wise) of designing a site for either. –  AJ Henderson Mar 22 '13 at 14:19

Security advantages on the server side, or client side?

For serverside (hacking the server - getting access to the server files) I don't see any advantages to do either one or the other. They are both files that do nothing. If you use PHP or another serverside language, that may cause problems, but then it's PHP, not Flash or HTML5.

On the client side, Flash is known to have vulnerabilities and it's used quite often to attack a client computer. It does not really matter if your sites use Flash or not. It does matter if the client has flash installed, but that's not your responsibility.

If a visitor has no Flash installed and is forced to install Flash because of your website, and then visits another site that has a mallware flash banner, then he might get infected. Is that your fault?

Let's assume your webserver is not hacked, so there are no files that will infect a client computer on your server.

One problem I can think of with HTML5: cross site scripting, when you use javascript that is not properly setup that allows this to happen. E.g. if you use eval(), that's risky. Should you avoid HTML5 because of this? No!

share|improve this answer

I know of a few security advantages that HTML 5 has when compared to flash and one disadvantage,this answer may not be complete

-HTML 5 updates are delivered through browsers hence there is a greater chance of users updating to the latest patch(as opposed to flash's 3rd party plugins that require separate updates)

-i believe that HTML 5 access to system resources is more restricted than that of flash(will have to confirm this one, i will update this point if needed after further research)

-A large group of companies(facebook,apple,google etc) have pledged their support to HTML5 and hence a lot of research will happen on the security aspects from multiple companies

I believe(not extremely sure) that a major security disadvantage of HTML5 is that an attacker can easily view the source code of a game as opposed to flash where the attacker will have to crack the swf file.(i have not done that before so i do not know how easy is it to do so)I will update this point too, if needed after further research

Apart from comparing html5 security to flash, there is a whole set of new features with html5(for eg cross domain access,offline storage) that can make it more vulnerable than regular html, but that can be another question.

share|improve this answer

There's a few deadly exploits employed by HTML5 that can't be patched, except by the browser itself. The bad thing about patching things like this is that it eliminates functionality as a whole. Things web devs found useful are now restricted because someone abused it.

Flash only needs block "strings" in their patching, allowing useful function to remain. Adobe was simply lazy about updates and patches etc.. as a language, AS3 is superior and it uses less battery than HTML5

HTML5 is proving to be quite dangerous, although it runs so well (same effects as flash via the canvas) old browsers in dated OS's are able to view it. I hear Mac OS9 is reviving thanks to HTML5, there's even reports of Win 3.1 displaying HTML5 content at full speed. Interesting... if only old machines could improve hardware wise, or at least let us install older OS on raspberry pi's

share|improve this answer
    
Can you provide sources for the unpatchable HTML5 exploits? For example, is it possible to execute arbitrary code on a client and compromise a machine via HTML5? Also, I'm not sure that your last paragraph adds value to your answer. –  schroeder Jul 14 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.