Securing the Social Web by Moving Beyond Client-Server Security - - PDF document

▶

Apr 23, 2023 371 likes •448 views

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... Securing the Social Web by Moving Beyond Client-Server Security Tyler Close Google, engineer Client-Server Model Isolated clients connect to a single server. One

SLIDE 1

Securing the Social Web by Moving Beyond Client-Server Security Tyler Close Google, engineer Client-Server Model Isolated clients connect to a single server. One identification and one possible attacker. Web Model

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 1 of 6 2010-11-11 19:47

SLIDE 2

Social (email, chat, napkins, …) clients connect to many servers. One identification but many possible attackers. Web as Client-Server When used as a Client-Server model, all those extra arrows are attack

vectors. Different names for different

combinations: phishing, XSS, CSRF , clickjacking, … Phishing One client gives another a link to an

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 2 of 6 2010-11-11 19:47

SLIDE 3

unexpected server. XSS A client gives a server content that it gives to another client. CSRF or clickjacking A server gives a client a link to an unexpected server.

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 3 of 6 2010-11-11 19:47

SLIDE 4

But happy users Note the happy versus sad faces. Those other arrows aren't just attack vectors, they are also work and play vectors. Social Computing means ever more use of those other arrows. Need a different security model. Where to from here? Social Web means frequent referrals

ver diverse channels

Requests come from complex, multi-party collaboration "Who sent this request?" is a question with no useful answer "What access has been applied?" can be tracked using explicit token passing web-key Every URL for an access controlled

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 4 of 6 2010-11-11 19:47

SLIDE 5

resource carries the corresponding permission token.

./#s=4mrz4gknjpc6zi ./#s=(permission token)

But what if… … accidentally send web-key for bank account Don't put valuable web-keys in harm's way Put them in the Introducer instead Web Introducer DEMO: Edit a syndicated blog post Go forth and make secure, social, killer

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 5 of 6 2010-11-11 19:47

SLIDE 6

apps!

http://web-send.org/

QCon SF 2010 file:///home/recht/projekt/qcon/wed/Securing the w... 6 of 6 2010-11-11 19:47