The Perilous Future of Browser Security
summary
Claims browsers are critically insecure for 2.4 billion users and that fixes require hard tradeoffs: losing performance and features to gain safety. Specific mitigations listed include requestPolicy and NoScript, click‑to‑play, removing protocol handlers, splitting DNS/credentials, and sandboxing with VirtualBox and Windows 7 jails. Ads and tracking ($40B US market) drive many attacks; Do Not Track adoption metrics cited (IE10 ~86%, Firefox ~19%, Chrome ~2.8%). A privacy‑first browser called Aviator is built to opt users out by default.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:59Scale of our problem (not to scale)
- 3:36Security
- 4:53Shrinking bandwidth: managing competing demands
- 7:28You can't start a project without a goal
- 9:13Anonymity vs. Privacy
- 10:51Average websites today
- 14:30Command execution
- 17:50Data exfiltration and privacy
- 19:43Man in the middle
- 23:31Scorched earth approach
- 27:53Big business drives big data
- 28:56DNT: number one complaint
- 33:04DNT by the numbers: Part II
- 37:08Payoffs? What payoffs?
- 37:20The battle lines are drawn
- 39:30What's the "so what?"
- 41:03What is White Hat doing?
related talks
11mWhat your browser can teach you about software security
19mWeb Platform Security
55mWeb Application Security: Browsers Fight Back!
59mThe Final Frontier: Security APIs in Modern Browsers
44mThe Future of Cookies
56mDoes the Browser have a Future?
50mThe Future of Cookies
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface