Friday, March 10, 2017

nz.js(con): Your browser wants you to be secure

Today I had the pleasure of speaking at the first nz.js(con) in Wellington - a Javascript conference held over March 9 & 10, 2017. The conference has been a great mix of different javascript (and related) topics, and I really recommend that anyone involved in web application development attends future iterations of the conference.

My talk was titled "Your browser wants you to be secure". The idea was to rapidly present in a short 30 minute presentation all the cool work that browser vendors are doing to help make our web apps more secure. Browsers have really focussed heavily on technology to make the web a safer place for people to browse, and I thought it was a good time to step back and look at all the changes and how they affect our apps.

A friendly red superhero named "PoolDead" has some ideas of how you can stop the evil baddies. Look out for for a red face next to things you should do.

You can view the talk slides on Google Slides, or download a 3mb PDF of the slide deck.

Or here's a video of the talk (30 minutes):


The talk was heavy on URLs with additional reading and details of things to look at. A lot of the links go to Google Chrome resources, because that's currently my favourite browser. Most browsers have comparable features and enhancements.

Also, I've heavily linked to Scott Helme's blog. He has a lot of useful, well written posts on HTTP headers, and also runs a useful service called The NZ branch of the Open Web Application Security Project. We run regular meetups in Wellington, Christchurch and Auckland, and an annual (free) conference. 1992 definitions of HTML tags - Michal Zalewski's really cool book that talks about the history and current state of browser security. This is probably my favourite security book. The original Chrome comic published when Chrome launched back in 2008.

Microsoft and Google's commitment to browser security extends to financial rewards:

XSS protection links:


"AWS Only" Chrome Extension:

(send me feedback to @kirkj)

Certificate Transparency:

Facebook Certificate Transparency monitoring tool


SHA-1 is considered broken:

SSL Labs’ Server Test

Strict Transport Security:

Public Key Pinning:

Browser Security Messages:

Referrer Policy:

Sub-Resource Integrity:

Mixed Content:

Clear site data:



People to follow:

Adrienne Porter Felt @__apf__ Chrome Usable Security
Eric Lawrence @ericlaw Creator of Fiddler, IE team, now Chrome
Mike West @mikewest Chrome / Blink, Content Security Policy and other standards
Scott Helme @scott_helme Creator of @reporturi and @securityheaders

Risky Business podcast: