WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring
summary
WPSE is a browser-side monitor implemented as a Chrome extension that enforces protocol flow, integrity constraints, and secrecy by replacing tokens with placeholders and only restoring them for authorized origins. It has a formal proof (applied pi calculus) of preserving safety under a compromised browser, finds concrete implementation bugs and tracker leaks (e.g. Facebook Pixel), and discovers a novel SAML Google vulnerability. An experimental run shows 55/90 sites (61.1%) vulnerable while WPSE works on 83/90 sites (92.2%) with seven compatibility issues.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:34OVERVIEW OF A WEB PROTOCOL
- 1:56MOTIVATIONS
- 3:40SECURITY CHALLENGES IN WEB PROTOCOLS
- 4:54TACKLING THE CHALLENGES IN WPSE
- 6:52FORTIFYING OAUTH 2.0
- 9:30SESSION SWAPPING SB12
- 10:55STATE LEAK ATTACK FKS16L
- 12:04FORMAL RESULTS
- 13:04EXPERIMENTAL EVALUATION
- 14:32A NEW ATTACK AGAINST GOOGLE IMPLEMENTATION OF SAML 2.0
- 16:00SUMMING UP
related talks
19mWeb Platform Security
55mWeb Application Security: Browsers Fight Back!
42mPrivacy Toolkit: Privacy Awareness In The Digital Age
51mWeb Platform: The Secure Parts
37mFront-end Security
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
59mThe Final Frontier: Security APIs in Modern Browsers
49mSecurity and Insecurity of HTTP Headers