Subject: Re: [websec] WEBSEC and The Need for More Than DNSSEC

From: Travis Hassloch <[email-masked]>
Date: Mon, 1 Nov 2010 13:45:57 -0700

On 10/26/10 10:55 AM, "Marsh Ray" <[email-masked]> wrote:

> I don't like where this is going.
> What's a "web browser"?

A: Two echoes and a netcat.

> There have been innumerable code-signing schemes proposed and deployed
> over the years and I doubt any of them have increased security one bit.

http://www.subspacefield.org/security/security_concepts/index.html#tth_sEc27
.3

> In your vision of the secure web, everyone will be required to be
> running an approved, "compliant" browser and register their computer
> with some central authority.

http://xkcd.com/129/

> But you didn't explain how this grand scheme of "compliance" is going to
> prevent any of the current real-world security holes:
> 
> Q: What will it do about Adobe PDF and Flash plugins that come
> preinstalled with dozens of exploitable security holes?

It will distract me from fixing them :-)

Sorry, I couldn't resist this chance to introduce myself.

I'm on the Flash security team (not responsible for Acro*).  I'm tasked with
implementing many of the HTTP-related security headers.  I'm thinking that
S-T-S, C-S-P and nosniff might be the most important.  If anyone thinks that
others might be more apropos, please email me off-list; I'm trying to set
priorities without having had time to become an expert on them.  I'm also
looking for information on current status; we don't want to be the weak link
in deploying them, but it's important to not pass on one that's currently
deployed in order to implement one that will have only latent value.

Security is gaining increasing importance here, despite not being a (for
lack of a better word) flashy kind of thing you can demonstrate on-stage at
developer conferences.

> Q: What will it do to support individual privacy, anonymity, and control
> the leakage of their personal data and prevent
> marketers/credit bureaus/insurers/governments/attackers from tracking
> their every movement online?

http://knowyourmeme.com/memes/i-for-one-welcome-our-new-overlords

BTW, Barth, typo:
http://tools.ietf.org/tools/rfcmarkup/rfcmarkup.cgi?draft=draft-abarth-origi
n
The first instance of "principal" lacks an r.

Thanks!
-- 
Travis Hassloch
Flash Player Security Engineer

---

From: Adam Barth <[email-masked]>
Date: Mon, 1 Nov 2010 13:53:35 -0700

On Mon, Nov 1, 2010 at 1:45 PM, Travis Hassloch <[email-masked]> wrote:
> BTW, Barth, typo:
> http://tools.ietf.org/tools/rfcmarkup/rfcmarkup.cgi?draft=draft-abarth-origin

Yeah, that one is pretty embarrassing.  I've fixed it locally.  Thanks.

Adam