The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
2answers
150 views

Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]

I have been asked to post this here: I want to focus on the security of the end-user in these two different scenarios: 1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
45
votes
3answers
4k views

For an end-user, is HTML5/JavaScript more secure than Flash?

I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
12
votes
1answer
300 views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but ...
7
votes
1answer
133 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
27
votes
4answers
8k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
2
votes
2answers
613 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
3
votes
2answers
157 views

Can postMessage be used to forward data to hacker's iframe in CSRF attack?

Consider a user that has an open session to a legitimate site with a password on it. This page has no anti-CSRF token. A hacker creates a webpage with 2 hidden iframes. One iframe does a GET on the ...
6
votes
1answer
615 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
1
vote
1answer
208 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
1
vote
0answers
510 views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
5
votes
1answer
1k views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
2
votes
1answer
135 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
12
votes
2answers
3k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
1
vote
1answer
79 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
5
votes
2answers
2k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
6
votes
3answers
9k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
0
votes
1answer
198 views

How does DOCTYPE selection affect security of my AJAX app?

I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
1
vote
1answer
6k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...
2
votes
2answers
618 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
7
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
1
vote
2answers
706 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
8
votes
1answer
2k views

How to use postMessage securely

postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication. What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
3
votes
2answers
924 views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
6
votes
2answers
1k views

HTML 5 Security Code Scanner

Are there code scanners in the market that scan HTML 5 code? Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
6
votes
3answers
1k views

How secure are self decrypting HTML files for data storage?

I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
9
votes
3answers
2k views

Are there any established secure coding guidelines available for mobile devices?

I am looking for secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. Would it be a good approach to use a ...
9
votes
3answers
1k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
29
votes
3answers
11k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
13
votes
3answers
1k views

Elaborate websockets security

I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved: ...