You Can't Always Get What You Want – How Web Sites...
summary
Measured across top 10,000 sites with five fresh requests per test using varying user agents, VPN/Tor and language settings, the team finds 321 sites with inconsistencies where identical pages return different security headers; a separate vertical scan of ~15,000 sites (up to 300 subpages) shows ~9% of unique cookies have differing security flags and about half of sites that expose a CSP on one page omit it on another. They prototype a site-policy manifest at /.well-known with site-wide defaults and explicit exceptions to force consistent enforcement.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:25Web security basics exercise
- 3:12Consistency in web security
- 4:17XSS and CSP recap
- 8:16Security headers for framing and encryption
- 13:21Header precedence rules quiz
- 16:13Security inconsistencies and the Security Lottery paper
- 25:28Causes and impacts of inconsistencies
- 26:31CSP nonce misuse and randomness
- 29:22Limitations of current security measures
- 31:32Site Policy as a solution
- 35:02Permissions Policy deep dive
- 39:58Best practices and closing
related talks
27mWho Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies
49mSecurity and Insecurity of HTTP Headers
43mRestricting the scripts, you're ...
46mHeaders for Hackers
45mHeaders for hackers
59mHTTP Security Headers You Need To Have On Your Web Apps
29mBrowser Security in 2017
53mI Wanna Deploy You, but My Senses Tell Me to ...