Security a Concern As HTML5 Advances 234
Trailrunner7 writes "Every technology innovation has its coming out party, and Google Inc.'s recent 'dancing balls' logo experiment was widely interpreted as a high-impact debut for HTML5. But web security experts are warning that the sprawling new web standard may favor functionality over security, enabling a new generation of powerful web-based attacks. They agree that there are security enhancements in HTML5, but all expressed the same concern: that the new specification will greatly increase the 'attack surface' of HTML — providing more avenues by which malicious code can be delivered through the web. 'HTML5 has an enormous amount of functionality. The (specification) is just huge,' said Jeremiah Grossman of security firm WhiteHat. The breadth of the new specification gives him concern. 'I know that we're still finding vulnerabilities in HTML4,' Grossman said."
New strategies? (Score:3, Interesting)
web security experts are warning that the sprawling new web standard may favor functionality over security, enabling a new generation of powerful web-based attacks.
MS will Embrace and Extend, but not Extinguish the potential for security holes.
Apple will probably do much the same, but might do the enhanced functionality bit also.
The BSD and *nix variants will only take on the functionality, most foolishly (using MBA "forced-upgrade-income" definition).
I'm more worried about advertisements (Score:4, Interesting)
While I'm sure some of the new functionality will be exploited, I expect most of the abuse will be from folks who want to push ads and track users.
Re:Those who complain about PDF w/scripts (Score:5, Interesting)
One of my favorite things about Flash is that it's easy to block and control. There's times when I want the functionality Flash is providing - but most times, I'd rather pretend that I don't have it installed. I was rather rudely reminded of this the other day when I installed Flash on my Android phone. I was all happy until I started browsing around. Until I get NoScript on my Android, Flash has been removed.
With this in mind, I'm wondering what level of control we might have over HTML5.
Re:I'm more worried about advertisements (Score:4, Interesting)
FUD (Score:4, Interesting)
The article points out no specific flaws. It just says that HTML is growing, therefore the chance of a hole (the "attack surface") also is growing.
Choose your poison. The same can be said about writing an app for an operating system. "Windows/Mac OS/Linux has an enormous amount of functionality. Therefore I'm concerned that there could be a lot of vulnerabilities."
Yes.
But the growth of the browser will not simply add to the overall size of the computer. Because of a big browser, you may have a smaller operating system. This is the idea behind Chrome OS.
It is not a perfectly equal replacement. If the browser grows 15 MB, that does not mean the operating system will shrink 15 MB. But one thing that is better about putting a feature in the browser is that more eyes are on it. There will be a lot more users who try to write a program in JavaScript than against even the Windows, even the iPhone, API. HTML 5 will bring about a lot more software developers and a lot more software development.
Re:Dancing balls? (Score:3, Interesting)
He has a point though, I personally love most of the new HTML5 features, but if every site starts piling on canvas animations, videos and audio it'll be annoying as hell.
I'd like to see this stuff become optional (on a browser basis and not site-by-site), perhaps don't start playing (or loading) a video/audio/canvas element until the user explicitly clicks play (with an option to pre-load but not autoplay for those with no bandwidth limits but who still don't want annoying unwanted video/sounds).
Unfortunately most browsers seem to struggle with the idea that I don't want Flash by default (and the browser creators are the most vocal enemies of Flash) so I definitely can't see this happening.
Re:Dancing balls? (Score:3, Interesting)
You might want to consider upgrading your machine... I had no issues when the danging balls were on the homepage and my machine is 3 years old. I quite liked it actually.
Re:More features == More potential security holes (Score:3, Interesting)
The point that security researchers have been trying (for years) to get across to developers and companies alike is that ALL software/protocols/standards/whatever should be developed with security in mind from the beginning. Granted, even with secure coding practices and rigorous application security testing, there will always be some vulnerability that gets overlooked by the developer or discovered by an attacker. The thing is that most companies tend to put functionality and features far above security, which is IMHO a completely ass backward way of doing things when it comes to technology in general.
Re:As opposed to what? (Score:3, Interesting)
How are the "concerns" over HTML5 any different than any other platform? Flash, ASP, javascript, etc have all had and continue to have vulnerabilities. The only way to stay 100% safe is to stay off the internet. Did anyone expect people who make their living by addressing both real and imagined security risks to not comment with an angle that puffed up their importance in the net ecosystem?
Actually this is a very very important point. You can't compare the potential security risk betwenn HTML5 and HTML4. You have to compare it with HTML4 plus all the plugins it can potentially replace (like, say, Flash).
My biggest concern, as others have pointed out, are using things like canvas elements over top of content to display ads and whatnot. But then, really, it will just be like the new features of any previous HTML/Javascript spec. There will be a lot of annoyances and some features used in really bad ways (blink tag, anyone?) but then things will calm down and use it in practical ways. Browsers and browser plugins will get smarter about ad blocking features with the newer technologies and methods and we'll all be better for the useful things that HTML5 does provide.
There's a REASON that "web developers" get excited when talking about the future of HTML5 and how things are being developed and supported. If you don't understand why, then you probably weren't doing web stuff in the days of the IE and Netscape fighting it out or the long drawn out HTML4/Early CSS specs that were useless because MS was so slow in bothering to update IE. Sure we still have some divides (video tag, for example) but nothing as bad as it was. ANd sure, MS is a bit slower than the rest with IE8 and IE9 but these releases and evolving support of actual specs are LIGHTNING fast for MS compared to before...
A huge risk in HTML5 (Score:4, Interesting)
Let me start out by reminding everyone that when Netscape came up with Cookies, everyone thought they were fine. Now, thanks to 1 pixel images and other tracking methods, cookies are the key to online companies aggregating bits of "anonymous" data into an identifiable profile of a person. Does Google know only as much about you as you would like? In fact, they know far more about you than you would expect, even if you don't use GMail.
The single biggest shot across the bow to privacy in HTML5 is the ping attribute [w3.org]. It may seem innocuous at first glance, but according to MozillaZine [mozillazine.org], it sends an HTTP POST request to each url. Why not GET instead?
This will allow Google, Alexa, FaceBook, or any "partner" to track users, if a site implements ping, easier than ever before. Some say trackers will migrate away from redirect URLs, but I say they will do both, if only to sop up every last piece of data they can.
I can see ping being used as a stealth DDOS attack, if enough malicious links can be distributed. Some content provider web API gets hacked, thousands of sites load up links (via AJAX) that ping slashdot.org, and Slashdot goes down. Will ping implementations be smart enough to reduce the list of URLs down to unique values? How many times does ping="slashdot.org slashdot.org/foo slashdot.org/comments.pl slashdot.org/article.pl" actually hit the poor, unsuspecting server? There's no apparent limit to how many URLs can be stuffed into a single ping, either.
I'm sure the black hats will think of other ways to exploit this. I agree that tools are neither evil nor good, but this is ripe for unintended consequences.
Re:Those who complain about PDF w/scripts (Score:5, Interesting)
That's not possible in the current spec. The browser has no idea that a canvas is even being used for animation, let alone when an animation has completed. Well, OK, a simple heuristic of "if this canvas is being repeatedly updated, it's an animation" is possible. But the problem is you still don't know when an animation has looped once.
The best thing that can be done is to refuse to update a canvas after it's been updated once.
So then people start removing and replacing the canvas element... Or use video instead... Or start using the audio APIs...
Really, a lot of the new APIs are really cool from a web developer "whiz-bang" point of view, but the HTML5 spec authors don't seem to give a damn about actually providing control to the user. Rather it's the whole "it's MY content, you MUST view it MY WAY!!! " stance yet again.
On the other hand, there's the thing where you can't full screen video in HTML5 because evil web page authors might some how trick people into typing their password into a video. Yet you can full screen Flash - they seem to have come up with a solution (the "press ESC to exit full screen" banner) so it's not like there's absolutely no way to protect users.
So who knows what the HTML5 developers are thinking, because the inability to full screen HTML5 video makes it a complete non-starter versus Flash video. Especially if you want to share HD video.
Re:Dancing balls? (Score:3, Interesting)
I googled around that day and found lots of people complaining. Aparently for Chrome it wasn't a problem, but Firefox users were hosed.
You'd think they would test it for multiple browsers at Google, before pushing it to one of the most used pages of the web...
Browsers should be strictly sandboxed! (Score:2, Interesting)
Browsers, IM tools, Skype, and other such tools should ALWAYS run under very restrictive permission levels. I don't need my browser writing anywhere on my computer except for maybe one folder (usually). I don't need it changing the registry. I don't need it to be able to unsandboxed execute code.
So keep it isolated using permissions. That is the the last line of defense against malicious sites.
That would solve a great number of problems.
Re:A huge risk in HTML5 (Score:3, Interesting)
Why does it matter if its a GET or POST? I mean, why would you want GET? More chances that the URL will contain sensitive data that gets logged in more places. My webservers log GETs with all their encoded data by default, but the only thing I know about posts in the log is that they were posts and I know nothing about whats in them. My browser did, and so did the proxy that brought that post into the actual web servers, so its not like they can 'hide' information in there that you 'cant' see.
From the link you gave:
Emphasis mine. You can bet it will default to prompt initially in most browsers. Makes it fairly easy to control. Much has been learned since cookies came out, and the ping attribute is an attempt to use that experience.
You're worried about how it can be abused and completely ignore that its really simple for a browser to not allow anything you mentioned to happen. You could already do a DDOS with hidden iframes that would accomplish the same thing for instance.
Its no worse thank cookies, is just as controllable as cookies in every way, and is designed to fill a specific roll that is already filled using a bunch of kludges.
Re:Those who complain about PDF w/scripts (Score:2, Interesting)