The Fine Art of Hari Kari (.JS), And Other Approaches For The Strange Reality Of Web Defense
- Type
- Slides
- Tags
- web, web application
- Authors
- Dan Kaminsky
- Event
- Source Conference Boston 2010
- Indexed on
- Mar 26, 2013
- URL
- http://www.sourceconference.com/bos10pubs/DanK.pptx
- File name
- DanK.pptx
- File size
- 765.2 KB
- MD5
- 5ad2b6f9bee35139c25346c0191b7de8
- SHA1
- 3091d502de5a90f7dbfa5e8c4338ca69a064171b
The web is remarkably difficult to secure. Browsers are ornery, powerful creations, and we security people demand all sorts of things of developers to make them behave. By in large, the developers ignore us. Our asks, they say, are too expensive. Rather than just guilting them, could we make better asks -- of both web developers, and browser manufacturers? Possibly. In this talk, I explore a couple of interesting techniques for easily mitigating entire classes of Cross Site Scripting and Cross Site Request Forgery attacks. They aren't perfect, but they work, and more importantly they represent a new class of ask for browser manufacturers that might even be implementable past the genuinely more powerful forces of application compatibility, performance, and developer compliance. I will also discuss Treelocking, a generic mechanism for mitigating injections into protocols as diverse as SQL, LDAP, XML, and JSON.
About us
Secdocs is a project aimed to index high-quality IT security and hacking documents. These are fetched from multiple data sources: events, conferences and generally from interwebs.
Statistics
Serving 8166 documents and 531.0 GB of hacking knowledge, indexed from 2419 authors from 163 security conferences.
Contribute
To support this site and keep it alive, you can click on the buttons below. Any help is really appreciated! This service is provided for free, but real money is needed to pay bills.
