RuhrSec Day 2022
2022-05-05
Bochum, Germany
who it's for
web security engineers, browser security engineers, security researchers, application security engineers, extension developers, identity and access engineers, penetration testers
topics
content security policy deployment; CSP nonces and strict-dynamic; browser extension static analysis; tab.executeScript universal XSS; STARTTLS negotiation stripping; implicit TLS migration; cache side-channel mitigations; prime-prune-probe profiling; SSO popup and iframe security; EEG brainwave authentication evaluation
| title | author | length |
|---|---|---|
| Conference Opening | Marcus Niemietz | 07m |
Conference restarts after a COVID pause and traces RuhrSec’s growth from a small local meetup to a station-near event, outlines offerings like pro bono… | ||
| I Wanna Deploy You, but My Senses Tell Me to ... | Sebastian Roth, Ben Stock | 53m |
Analysis of ~10,000 sites over 12 weeks shows CSP adoption rises but is often ineffective: 95% meaningless (unsafe-inline, data: URIs or open https wildcards)… | ||
| Secure Cache Designs: State of the Art and ... | Lukas Giner, Daniel Gruss | 39m |
Overview of concrete results and prototypes assessing secure cache designs with numbers and attacks. Shows that Prime‑prune‑probe reduces profiling time by… | ||
| Why TLS is better without STARTTLS ... | Damian Poddebniak, Fabian Ising | 36m |
Structured testing with the semi-automatic EAST toolkit finds over 40 STARTTLS-specific issues by analyzing 28 clients and 23 servers, with only 3 clients and… | ||
| DoubleX: Statically Detecting Vulnerable Data Flows in Browser ... | Aurore Fass | 38m |
Built a static analyzer called DoubleX that finds external attacker-to-API flows in Chrome extensions and runs in seconds per extension. Analysis of 155k… | ||
| Modern Single Sign-On: On the Security of Single Sign-On ... | Louis Jannett | 40m |
Claims that modern SSO flows in popups and iframes expose new web-attack surfaces: three practical bug classes—wildcard receiver, malicious receiver, and… | ||
| For Smarter Authentication, We Might Need to Use ... | Patricia Arias-Cabarcos | 33m |
Evaluates brainwave authentication using 14-channel consumer EEG with 52 participants and stimulus tasks (oddball P300, N400, priming, faces). Achieves an… | ||
| nothing matches | ||