Hot answers tagged

53

In theory, if all servers and connections to them were perfectly secure (impossible) and trustworthy (not true), neither one would be more "secure" than the other - mainly because the developer(s) of the website are in full control of the content of the site. Since Flash and the JS is served to clients, the server would have to serve malicious content to the ...


30

In addition to WillS' excellent answer, a couple more differences that affect security: Flash is a product, while HTML5/Javascript is a specification. With a product (and especially a closed-source one), you always depend on the vendor to play a game of whack-a-mole (which Adobe is doing admirably, but long term it is a losing battle). A specification can ...


22

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


20

At least the author wrote a rather clear page on how his encryption works. Notwithstanding, this looks like a rather old-style homemade stream cipher, which is not good news, since most of such systems have been thoroughly broken. It appears to consist of a basic LFSR subsystem (two LFSR with key-dependent polynomials; the bit about the polynomials operating ...


11

Pros It can improve security when authenticating (in addition to a multi-factor device) If used as a "client certificate", it can make MITM attacks much more difficult The Keygen tag is implemented across most non-IE browsers, making it very easy to implement Works regardless of administrator permission. With IE Active X controls can be disabled and IE ...


11

Actually, this has nothing to do with moving CryptoCat to a browser plugin/extension. It's not even related to SSL at all. Having that in mind, Stephen's answer is somewhat misleading. I'll attempt to address that. CryptoCat is still JavaScript & HTML. Give me your full attention, assume that SSL is doing its job and you're 100% sure that you're ...


10

WebSockets protocol is a tricky beast to evaluate right now, as it's changing frequently. After the flaws in draft-hixie-thewebsocketprotocol-76 of the WebSockets protocol discovered by Adam Barth et al. a few months ago, Firefox disabled WebSockets implementation in about:config preferences. Since then, a new protocol version is in the works, currently up ...


9

The obvious usage is client authentication. It can be used to improve security in combination with a passphrase or smartcard, or to be a convenient replacement for entering a password. The WebID single sign on protocol is an interesting proposal in this context. The main issue with client certificates is that it is bound to the browser. So if you are on ...


9

HTTPS is still an absolute requirement, and Matasano's main point is that JavaScript can never replace HTTPS. A MITM attack could deliver a custom JavaScript payload that could read any secrets in localstorage, and an XSS payload could also compromise this data. Matasano is wrong in regards to random number generators in JavaScript. Most browsers provide ...


7

In principle, values stored in sessionStorage are restricted to the same scheme + hostname + unique port, and if the browser has a clean exit these values should be deleted at the end of the session. However, according to this post it can survive a browser restart if the user chooses to "restore the session" after a crash (which means its values also exist ...


7

The issues are mostly the same as for secure software development in general. Note that the most critical issue for secure software development is (1) integrating security into your software development lifecycle (so security is integrated into each step of the process: design, implementation, maintenance, ops), and (2) training of developers. It is a ...


7

EME doesn't "allow" proprietary code, that's a misinformation of Wikipedia based on this four years old post , a post which does not provide real information, just the assumption that at some point a full DRM solution will be integrated into the browser. The EME is just an API to interact with the license server and the Content Decryption Module. This CDM ...


6

Local storage is a relatively new feature available to web applications, but some kind of 'industry standards' or best practices have already appeared. OWASP HTML5 cheat sheet considering your case states that: Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application requires can be ...


6

The W3C security instructions for this are surprisingly accurate and complete: Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, bugs in the author's message handling code could be exploited by hostile sites. Furthermore, even after checking ...


6

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))? See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet for information on how to prevent cross-site scripting (XSS). You will need to do data ...


6

Firefox The battery API is enabled by default. It can be easily disabled without using third-party addons. Go to about:config, accept the warning, look up the dom.battery.enabled boolean and set it to false. Changes take effect immediately on subsequent page loads. To deploy these settings in an enterprise environment you can use the user.js file which ...


6

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, giving an attacker more tools to craft an exploit. Yet, there are many different ways in which the implementation of the used CSS parser or other modules ...


5

No, I don't know any website that is doing this. Simply, because it's a silly idea. The DOM is in the memory, and when you access it you're accessing objects stored in the memory. If a website wants to do this, it would simply store the cookie in a JavaScript variable. var Cookie = 'COOKIE_VALUE'; But there are much much better ways of creating sticky ...


5

In this post in the chromium forum there are alternatives mentioned Within the browser space, alternatives exist such as: Use the device's native management capabilities if an enterprise use case. On Windows, this is Group Policy. On iOS/Android, this is the mobile device management suites. On OS X, this is Enterprise settings. On ChromeOS, ...


4

I suggest another approach: Instead of submitting the form to the server, use an XMLHttpRequest to create the account. If server side validation fails, the form and all its content is still available. If it was successful, redirect to the target page. This requires that JavaScript is enabled, but you still can fall back to normal form submission. Access to ...


4

You will be having hard time deciding on which of the two stored values to use as the user's intended password (the one in the local storage, or the one in the input field), if none of them are empty but for some reason differ. This can potentially provide for a social engineering attack vector, where the attacker prepares a trap by opening the registration ...


4

The problem with all of these types of things is that you can't really determine how secure they are. What we do instead is place some trust in ones that have been tested over time by a large number of experience people (@ThomasPornin has an excellent answer on this, which I will try and find a link to) - this is probably why the author has placed the ...


4

I work for HP and I do know that our commercial security-focused static analysis tool, Fortify SCA, does support HTML5 security issues. Feel free to let me know more if you decide to go this route!


4

There are no 'scanners' yet, but you might be able to enrich existing code scanners with new rules for the HTML5. OWASP HTML5 Security Cheatsheet is a good resource you might use to compile such rules, for example it lists insecure CORS headers configuration, but it also touches other HTML5 subjects like insecure WebSockets configuration. You can also add e....


4

Here are a couple of useful resources discussing WebSocket security - all of them pretty detailed: Delivering Security Over Native Full-duplex Web Connections - a free whitepaper from Kaazing's founder & CTO HTML5 WebSocket Security is Strong - a generic WebSocket security overview Kaazing WebSocket Gateway Security is Strong - a security post on the ...


4

I think it could be used to mitigate session hijacking. A server could authenticate a client and then prior to taking input from a client the server could perform a check on the client. The spec also allows you to generate a public key and challenge. Prior to submitting important information in a form, it would be nice to be able to reauthenticate the server....


4

Honestly, the core question is whether vibration of the phone will give an application/website significantly more authority than without the vibration. Now, obviously I lack any research into this specific issue, but we can note that applications do not use vibrations as a way to convene authority. If anything it would feel wrong for an application to ...


3

@Krzysztof Kotowicz has a good answer. I concur with his recommendations. Another possibility, for web applications that really want to store sensitive information on local storage, might be to store it in encrypted form. The client-side application could encrypt and authenticate it (using a symmetric-key encryption algorithm and a message authentication ...


3

The purpose of the element is to provide a secure way to authenticate users. The tag specifies a key-pair generator field in a form. More can be found here http://www.w3schools.com/html/html5_form_elements.asp



Only top voted, non community-wiki answers of a minimum length are eligible