HTML5: Risky Business or Hidden Security Tool Chest?
summary
HTML5 features produce concrete tradeoffs: local/sessionStorage used for device tokens can block CSRF by keeping tokens out of cookie headers but exposes data to XSS and lost devices; a live canvas pattern login (github repo authonthemove.com) demo shows usability limits as users reuse simple shapes; stream API for camera biometric attempts and accelerometer offer extra signals but camera face/pulse tests are noisy and getUserMedia support is incomplete while the WebCrypto API is not yet widely implemented so client-side hashing and push notification flows require careful fallback and SSL.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:25What is HTML5
- 2:51Mobile applications
- 3:38Authentication
- 5:15Multifactor
- 7:39Flash Cookies
- 9:19Surf Crosstalk
- 10:36Risks
- 12:03Opera Mini
- 12:48Canvas
- 13:20Interactive Login
- 13:53Connect Dots
- 14:25Android Pattern
- 14:44Demo
- 15:10Canvas Support
- 15:39Mobile Devices
- 16:42Geolocation
- 17:36Browser fingerprinting
- 20:09Face detection API
- 22:26Supported devices
- 23:09Accelerometer
- 25:08Popup notifications
- 29:18Crypto
- 33:08How it works
- 35:41Summary
related talks
36mHTML5 JS Security
35mHTML5 APIs - The New Frontier
43mMake Friends and Influence People with HTML5
53mBreaking Limits on Mobile HTML5
59mThe Final Frontier: Security APIs in Modern Browsers
26mMobile HTML5: Device APIs and related APIs
18mWriting an (in)secure webapp
48mSecurity Risk: Single-Page Applications.