Mobile- Or Attacker-Friendly? A Security Evaluation Of Mobile-First Websites
summary
Large-scale crawl uses headless Chromium on one million sites and finds mobile versions arrive much later — median 6.8 years after desktop — producing 10,222 mobile-subdomain sites of which 512 compromised during filtering. Analysis checks 11 defense headers and 4 weakness classes, finds HTTPS on ~62% of sites, CSP deployed on ~5% but often misconfigured, and overall security-feature adoption is low (mostly <20%) and inconsistently attributed to developer effort.
AI-written summary · about
chapters (8)
- 0:00Start
- 9:17Discovered 512 compromised sites
- 16:37Use of defense mechanisms is not always required Depends on the mechanism and application
- 22:11Security features more prevalent on desktop
- 25:26Content Security Policy
- 26:13502 desktop sites, 482 mobile sites
- 31:21Adoption of security mechanisms is similar on mobile & desktop
- 37:09Your application will most likely have vulnerabilities
related talks
21mWhen Attackers Go Mobile-First: What Developers Need to Know
47mHow to put the Mobile in the Mobile Web
48mMobile Security Attacks: A Glimpse from the Trenches
48mA Weakness In Chrome & A New Hacking Technique
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
33mWhen Attackers Go Mobile-First with AI
46mFront performance: the mobile web
41mYou Can't Always Get What You Want – How Web Sites...