Basic web security model - Stanford Crypto Group

More documents

Recommendations

Info

Outline Web Refresher: Security User Interface Goals of a browser When is it safe to type my password? Same-Origin Policy How sites are isolated Opting out of isolation Frame hijacking Navigation policy Cookie <strong>security</strong> Browser <strong>security</strong> design
Same origin policy: “high level” Review: Same Origin Policy (SOP) for DOM: Origin A can access origin B’s DOM if match on (scheme, domain, port) Today: Same Original Policy (SOP) for cookies: Generally speaking, based on: ([scheme], domain, path) optional scheme://domain:port/path?params
Page 1 and 2: Basic web security model Elie Bursz
Page 3 and 4: Web security: two sides Web browser
Page 5 and 6: Outline Web Refresher: Security Use
Page 7 and 8: HTTP protocol HTTP is widely used
Page 9 and 10: HTTP Request Method File HTTP versi
Page 11 and 12: Security User Interface When is it
Page 15 and 16: Safe to type your password? 15
Page 17 and 18: Safe to type your password? 17
Page 21 and 22: Components of browser security poli
Page 23 and 24: Windows Interact 23
Page 25 and 26: Frames Modularity Brings together
Page 27 and 28: Masups: lots of frames (gadgets) 27
Page 29 and 30: Window Policy Anomaly top.frames[1]
Page 31 and 32: What should the policy be? Child Si
Page 33 and 34: Adoption of Descendant Policy Brows
Page 35 and 36: 35 Pages can embed content from man
Page 37 and 38: Mashups
Page 39 and 40: Recent Developments Cross-origin ne
Page 41 and 42: postMessage syntax frames[0].postMe
Page 43 and 44: Data export Many ways to send infor
Page 45 and 46: Sending a Cross-Domain GET Data mus
Page 47: Cookie Security How to make HTTP st
Page 51 and 52: Scope setting rules (write SOP) dom
Page 53 and 54: Reading cookies on server (read SOP
Page 55 and 56: Client side read/write: document.co
Page 57 and 58: Viewing/deleting cookies in Browser
Page 59 and 60: Interaction with the DOM SOP Cookie
Page 61 and 62: Browser security design How to buil
Page 63 and 64: Approach Fact: Browsers will always
Page 65 and 66: Frequency of interactions with atta
Page 67 and 68: World of Warcraft keylogger Flash P
Page 69 and 70: Now do it in the browser
Page 71 and 72: Introductions are easy Impressions
Page 73 and 74: Closing the vulnerability window Di
Page 75 and 76: Getting better, but not fast enough
Page 77 and 78: Severity "Medium" Universal XSS "Hi
Page 79 and 80: IE7 Containment Goals Arbitrary cod
Page 81 and 82: Chromium Security Architecture Brow
Page 83 and 84: Task Allocation
Page 85 and 86: Another approach: Cookie Blocking B

Basic web security model - Stanford Crypto Group

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?