Security a Concern As HTML5 Advances 234
Trailrunner7 writes "Every technology innovation has its coming out party, and Google Inc.'s recent 'dancing balls' logo experiment was widely interpreted as a high-impact debut for HTML5. But web security experts are warning that the sprawling new web standard may favor functionality over security, enabling a new generation of powerful web-based attacks. They agree that there are security enhancements in HTML5, but all expressed the same concern: that the new specification will greatly increase the 'attack surface' of HTML — providing more avenues by which malicious code can be delivered through the web. 'HTML5 has an enormous amount of functionality. The (specification) is just huge,' said Jeremiah Grossman of security firm WhiteHat. The breadth of the new specification gives him concern. 'I know that we're still finding vulnerabilities in HTML4,' Grossman said."
Those who complain about PDF w/scripts (Score:2, Insightful)
should also complain about a hyperText markup language document with scripts
I don't know about the rest of you (Score:5, Insightful)
But I'm really sick of hearing about HTML5. Maybe it's because every other day I see/hear a high level exec coming around and going crazy with statements like "HTML5 IS THE FUTURE WE HAVE TO BE ON IT. RIGHT NOW." Then I have to spend an hour explaining why it's not even currently usable for any serious enterprise application, and how the spec is not yet solidified.
The entire disarray of this, and the mobile space, makes up upset.
Dancing balls? (Score:4, Insightful)
"Google Inc.'s recent 'dancing balls' logo experiment "
If that's a sing of what's coming in HTML 5, I don't want it. That stupid thing dragged my machine to a crawl and I had to be sure I didn't have any google tabs open.
The last thing I want is for more &*^%*() CPU-hogging crap to be added to the friggin' web.
Re:I don't know about the rest of you (Score:5, Insightful)
Standards are important but without fancy technology buzzwords I don't think the IT department would ever get funding.
Optimize for the common case (Score:3, Insightful)
When HTML spec is extended that obviously increases the attack surface since popular browsers will have to support it. But in time it may replace a number of other technologies (Flash comes to mind), that -combined- may have a larger attack surface. And since displaying HTML is the core function of a browser, implementations are likely to be pretty solid compared to some add-ons.
So you'd have to look forward, and compare [average setup now] with [average setup in XX years from now]. If that comparison turns out positive, HTML5 is a move in the right direction.
stop using technology (Score:1, Insightful)
stop using technology
As opposed to what? (Score:5, Insightful)
How are the "concerns" over HTML5 any different than any other platform? Flash, ASP, javascript, etc have all had and continue to have vulnerabilities. The only way to stay 100% safe is to stay off the internet. Did anyone expect people who make their living by addressing both real and imagined security risks to not comment with an angle that puffed up their importance in the net ecosystem?
Re:Those who complain about PDF w/scripts (Score:3, Insightful)
Hopefully something akin to: image.animation_mode = once
-l
Re:I don't know about the rest of you (Score:5, Insightful)
Re:I'm more worried about advertisements (Score:1, Insightful)
You've been open to launch pop up windows with javascript for a really long time. That had nothing to do with HTML5...
Fear, Fear, FEAR! (Score:3, Insightful)
said Jeremiah Grossman of security firm WhiteHat.
So you really need to buy their security solutions! NOW! Meanwhile, Goodyear tires said to really safe on the road (and to keep your CHILDREN! safe) you should get new tires every 5000 miles, and the Head & Shoulders folks claim washing your hair three times a day will avoid a stinky head. And the government said they taking blood and tissue samples at the airport will protect us from engineer^H^H^H^H^H^H terrorists ever more so.
The Modern Techie (Score:3, Insightful)
The Modern Techie will now by definition reject all new technology no matter what advancements are in it. While adopting any new technology will have tradeoffs the modern will hold on to whatever tradeoff negative effect and call it a horrible plan. Any new tech is now a threat to their way of life and no longer a new interesting field to study...
I think us techs have gotten too old.
Re:Dancing balls? (Score:5, Insightful)
Re:More features == More potential security holes (Score:2, Insightful)
Re:Dancing balls? (Score:2, Insightful)
Four seconds for that page to respond (Score:5, Insightful)
Just because a spec isn't finalized doesn't mean some of the feature haven't been implemented. You can find what's been implemented [html5readiness.com] and just maybe, impress your boss.
The web page you linked is an example of what can go wrong with HTML5 in the wrong hands: it ends up just like Flash in the wrong hands has ended up for years. Not only does it use mystery meat navigation [webpagesthatsuck.com], but it also takes literally four seconds from when I move the pointer to when another wedge of the graph lights up. I'm using the latest release version of Firefox (3.6.10) on Windows XP.
Re:Those who complain about PDF w/scripts (Score:4, Insightful)
o.O
Let's see...
Browser... settings... Enable plug-ins... on demand.
Well, I'll be.
How can HTML4 be vulnerable? (Score:5, Insightful)
It doesn't even contain any code, being a markup language? It's not even Turing complete.
[italic attribute="question"]Is this invented markup language of mine also vulnerable?[/italic]
*shrug*
Re:A huge risk in HTML5 (Score:3, Insightful)
It looks like that option was included with the intention the browsers implementing the feature would have a method to disable it's usage. I'm guessing if it gets crazy then major players will ship with it disabled, or maybe include some sort of same domain policy for pings (ping domain has to match referrer or href). I'm not too scared, and this would work much better than JS versions of the same thing.
My concern (Score:3, Insightful)
I'm not an expert of any kind, but my general concern with the web has been growing as static documents have become applications. It's the same reason I don't like the idea of javascript in PDFs. I like the idea of a static document that doesn't do anything, but is merely viewable. Yes, yes, I know that it's possible for malformed documents to trigger exploits in the document viewer, but that seems like it should be more rare and easy to protect against.
At you upgrade HTML to make web applications more and more powerful, it seems likely to me (from a non-expert standpoint) that you're increasing the variety of security concerns we need to worry about. There's a part of me that wishes we had two different things: a web browser that allowed for safe passive viewing of relatively static content, and an application that supported an application framework similar to current web applications.
Ok, I'm ready for people to yell at me for being stupid now.
Re:I don't know about the rest of you (Score:1, Insightful)
Well then it just doesn't work in your case. In my career, I couldn't give a shot about "enterprise" apps. HTML 5 is making websites faster and better for some of my consumers, that is all
Re:Those who complain about PDF w/scripts (Score:3, Insightful)
Rather it's the whole "it's MY content, you MUST view it MY WAY!!! " stance yet again.
There is a cure for that attitude - for the same reason that Facebook pretty much wiped MySpace off the map, or the way Google turned Yahoo! into a has-been: Keep it clean and user-friendly, keep the ads un-intrusive, or face instant death in the face of superior (cleaner, less intrusive) products.
Re:Those who complain about PDF w/scripts (Score:3, Insightful)
You've never dealt with actual users, have you?
Go ahead. Explain to someone that in order to watch a video full screen they will need to either:
1. Context-click the video and choose the "Full Screen" option, assuming there is one. This only works when using the browser's built-in video controls, I think.
2. Click on the "expand" button to expand the video to take up the entire tab, and then use your browser's Full Screen feature, which is probably F11 except when it's something else. Or if you're using Safari, you're screwed.
Users want a nice little Full Screen button they can click on and be done with. Even if there's a work around, they're not going to be happy.
Besides, it's yet another reason to just stick with Flash: it provides this support already. So why use something else, especially when you need to encode twice to support all browsers?
Ultimately, it's a useless restriction. Sure, make it a white-list only feature, but why the hell forbid it entirely?