Where It Leaks and How to Protect Against Cross-site Exfiltration
summary
The talk explains XS-Leaks (cross-site information leak) attacks: how subtle cross-origin communication leaks can de-anonymize users or expose sensitive data. It shows concrete attack vectors and demonstrates how to implement browser-level defenses and mitigation mechanisms that are readily available in modern browsers.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:38Same Origin Policy basics
- 10:01Clickjacking with blur event
- 13:11SameSite cookie protection
- 16:22Blocking iframe embedding
- 18:32Fetch Metadata headers
- 21:28Cross-origin resource loading
- 25:14User ID enumeration protection
- 29:14postMessage security flaws
- 33:14Window frame counting attack
- 39:04Browser cache side-channel attacks
- 41:51Summary
- 44:20Further steps
