Web Application Content Security
We explore how password meters and password generators are included into web applications and how it should be done, in particular when external code is used.
Next, we investigate if and how browser extensions and modify Content Security Policy HTTP headers (CSP) by analyzing a large set of real-world browser extensions. We implement a mechanism which allows web servers to react to CSP header modifications by browser extensions.
Is CSP meant to prevent data exfiltration on the web? We discuss the different positions in the security community with respect to this question. Without choosing a side we show that the current CSP standard does in fact not prevent data exfiltration and provide possible solutions.
With login pages as the points of authenticating to a web service their security is particularly relevant. In a large-scale empirical study we automatically identify and analyze login page security configurations on the web, and discuss measures to improve the security of login pages.
Last, we analyze a standard proposal for Origin Manifest, a mechanism for origin-wide security configurations. We implement a mechanism to automatically generate such configurations, make extensions to the mechanism, implement a prototype and run several large-scale empirical studies to evaluate the standard proposal.
Content Security Policy
web application security
security HTTP headers
Programvaruteknik, Grupp C2
Steven Van Acker, Daniel Hausknecht, Andrei Sabelfeld, Raising the Bar: Evaluating Origin-wide Security Manifests
Naturally, a lot of private data is involved. Data that should be protected against unintended recipients, against hackers. To this end, the web community has come up with several protection mechanisms to secure the content of web applications.
In this thesis we analyze various client-side web security problems. For example we investigate the deployment of security critical web services like online password meters and password generators, and the client-side security configurations of login pages of the 100.000 most visited websites. We study how and if certain security problems are addressed by real world web applications, if sufficient protection mechanisms exist, and propose solutions to improve the state of the art for web security.
Annan data- och informationsvetenskap
Informations- och kommunikationsteknik
Doktorsavhandlingar vid Chalmers tekniska högskola. Ny serie: 4449
Chalmers tekniska högskola
ED, Rännvägen 6, Chalmers
Opponent: Davide Balzarotti, EURECOM, Sophia Antipolis, France