Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.

We are thinking about migrating to HTML 5, are there any security advantages in doing such a thing?

share|improve this question
    
You may want to watch this talk by Robert McArdle at BSides London 2012 - "HTML5 - A Whole New Attack Vector". –  Deer Hunter Mar 22 '13 at 13:21
    
Just checking... You're not doing anything that involves creating a login for the where Flash is handling the authentication, are you? I watched a video about six months ago that showed how simple it is to bypass that. Some web sites have flash content that's supposed to be "secure" and they used a Flash Login to protect it, but it's so easy to bypass that, you may as well not be bothering to provide a login at all. There's a blog post covering it here: blog.philippheckel.com/2011/03/01/… –  David Stratton Mar 22 '13 at 19:56
add comment

3 Answers

The risks of Flash are client side. When viewing an compromised site that is well designed (not susceptible to XSS), there should be no difference in security between Flash and HTML 5 since the content is not malware. The main security problem with flash is for the client. When they visit a site infected with Flash based malware, bad things can happen to their computer. It isn't a server side concern.

share|improve this answer
    
Also I would add that theoretically, Flash is dying (due to constant vulnerabilities) and HTML5 is rising. I'm hearing this for quite some time, but still I keep seeing Flash in use so... –  yzT Mar 22 '13 at 14:16
    
@yzT It is true that HTML5 is gaining on Flash, particularly since Flash stopped supporting Mobile platforms, but it doesn't really have anything do do with the safety (security wise) of designing a site for either. –  AJ Henderson Mar 22 '13 at 14:19
add comment

Security advantages on the server side, or client side?

For serverside (hacking the server - getting access to the server files) I don't see any advantages to do either one or the other. They are both files that do nothing. If you use PHP or another serverside language, that may cause problems, but then it's PHP, not Flash or HTML5.

On the client side, Flash is known to have vulnerabilities and it's used quite often to attack a client computer. It does not really matter if your sites use Flash or not. It does matter if the client has flash installed, but that's not your responsibility.

If a visitor has no Flash installed and is forced to install Flash because of your website, and then visits another site that has a mallware flash banner, then he might get infected. Is that your fault?

Let's assume your webserver is not hacked, so there are no files that will infect a client computer on your server.

One problem I can think of with HTML5: cross site scripting, when you use javascript that is not properly setup that allows this to happen. E.g. if you use eval(), that's risky. Should you avoid HTML5 because of this? No!

share|improve this answer
add comment

I know of a few security advantages that HTML 5 has when compared to flash and one disadvantage,this answer may not be complete

-HTML 5 updates are delivered through browsers hence there is a greater chance of users updating to the latest patch(as opposed to flash's 3rd party plugins that require separate updates)

-i believe that HTML 5 access to system resources is more restricted than that of flash(will have to confirm this one, i will update this point if needed after further research)

-A large group of companies(facebook,apple,google etc) have pledged their support to HTML5 and hence a lot of research will happen on the security aspects from multiple companies

I believe(not extremely sure) that a major security disadvantage of HTML5 is that an attacker can easily view the source code of a game as opposed to flash where the attacker will have to crack the swf file.(i have not done that before so i do not know how easy is it to do so)I will update this point too, if needed after further research

Apart from comparing html5 security to flash, there is a whole set of new features with html5(for eg cross domain access,offline storage) that can make it more vulnerable than regular html, but that can be another question.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.