TOP
Search the Dagstuhl Website
Looking for information on the websites of the individual seminars? - Then please:
Not found what you are looking for? - Some of our services have separate websites, each with its own search option. Please check the following list:
Schloss Dagstuhl - LZI - Logo
Schloss Dagstuhl Services
Seminars
Within this website:
External resources:
  • DOOR (for registering your stay at Dagstuhl)
  • DOSA (for proposing future Dagstuhl Seminars or Dagstuhl Perspectives Workshops)
Publishing
Within this website:
External resources:
dblp
Within this website:
External resources:
  • the dblp Computer Science Bibliography


Dagstuhl Seminar 18321

Web Application Security

( Aug 05 – Aug 08, 2018 )

(Click in the middle of the image to enlarge)

Permalink
Please use the following short url to reference this page: https://www.dagstuhl.de/18321

Organizers

Contact


Motivation

Since its birth in 1990, the Web has evolved from a simple, stateless delivery mechanism for static hypertext documents to a fully-fledged run-time environment for distributed, multi-party applications. Even today, there is still a continuous demand for new features and capabilities which drives the Web’s evolution onwards. This unplanned and often chaotic development has led to several deeply ingrained security and privacy problems that plague the platform:

  • The Web’s original hypertext, multi-origin nature which is manifested in the design of HTML and HTTP is in fundamental conflict with JavaScript’s Same-Origin Policy, the Web’s most important security mechanism.
  • Important security properties, such as end-to-end communication security or endpoint identity are outside of the control of the actual applications. Instead, they depend on the security of external entities, such as domain name servers or certificate authorities.
  • Data/code separation in web applications is practically infeasible, as the HTTP link between server-side application logic and client-side application interface requires an intermixing of protocol, data and code fragments within a single continuous character stream.
  • HTTP is a stateless protocol without a native session or authentication tracking concept.
  • Users are not aware of general or application specific threats. Protecting against these threats (incl. to know which security indicators to trust) is nowadays difficult and time consuming.

Using this fragile basis, critical applications are created, that long have left the strict client-server paradigm, on which the Web was initially built. Instead, scenarios are realized that involve several mutually distrusting entities in a single security and application context. In many cases the browser is the link that connects the remote parties, either via direct JavaScript inclusion, web mashups, or through the usage of web protocols, such as OpenID and OAuth.

The accumulated ballast of the last two decades of web evolution, the ever growing functional demands of sophisticated web applications and the ambitious vision of the web platform’s drivers creates an exciting tension field which is in constant conflict with the required security assurances of high value business applications.

Since approximately ten years, academic security and privacy research has recognized the importance of the web platform and the unique characteristics and challenges of the web security and privacy topic. And while specific techniques, that originated from academic research, such as the Content Security Policy, have been adapted in practice, the fundamental security problems of the web remain and the overall vulnerability landscape is getting worse, as it can be seen in the constant flow of reported web security issues in bug trackers and vulnerability databases.

Academic web security research has started 2007 and usable security research started almost at the same time. In the context of this Dagstuhl Seminar, we will revisit the lessons learned from the last decade and revisit the success stories and mistakes that have been made. Questions, that have to be raised in include “What has worked?”, “What has been taken up by industry?”, “What failed and why?”, and – most importantly – ”What did we learn?”

Today, several unconnected groups drive the topic, including Security, Privacy as well as Usable Security & Privacy Academics, standardization, and browser vendors. The seminar will facilitate essential exchange between them. This will allow academia to directly influence browser vendors and standardization representatives, and allow industry representatives to influence the research community.

Copyright Martin Johns, Nick Nikiforakis, Melanie Volkamer, and John Wilander

Summary

Introduction

Motivation

Since its birth in 1990, the Web has evolved from a simple, stateless delivery mechanism for static hypertext documents to a fully-fledged run-time environment for distributed, multi-party applications. Even today, there is still a continuous demand for new features and capabilities which drives the Web's evolution onwards. This unplanned and often chaotic development has led to several deeply ingrained security and privacy problems that plague the platform:

  • The Web's original hypertext, multi-origin nature which is manifested in the design of HTML and HTTP is in fundamental conflict with JavaScript's Same-Origin Policy, the Web's most important security mechanism.
  • Important security properties, such as end-to-end communication security or endpoint identity are outside of the control of the actual applications. Instead, they depend on the security of external entities, such as domain name servers or certificate authorities.
  • Data/code separation in web applications is practically infeasible, as the HTTP link between server-side application logic and client-side application interface requires an intermixing of protocol, data and code fragments within a single continuous character stream.
  • HTTP is a stateless protocol without a native session or authentication tracking concept.
  • Users are not aware of general or application specific threats. Protecting against these threats (incl. to know which security indicators to trust) is nowadays difficult and time consuming.

Using this fragile basis, critical applications are created, that long have left the strict client-server paradigm, on which the Web was initially built. Instead, scenarios are realized that involve several mutually distrusting entities in a single security and application context. In many cases the browser is the link that connects the remote parties, either via direct JavaScript inclusion, web mashups, or through the usage of web protocols, such as OpenID and OAuth.

The accumulated ballast of the last two decades of web evolution, the ever growing functional demands of sophisticated web applications and the ambitious vision of the web platform's drivers creates an exciting tension field which is in constant conflict with the required security assurances of high value business applications.

Since approximately ten years, academic security and privacy research has recognized the importance of the web platform and the unique characteristics and challenges of the web security and privacy topic. And while specific techniques, that originated from academic research, such as the Content Security Policy, have been adapted in practice, the fundamental security problems of the web remain and the overall vulnerability landscape is getting worse, as it can be seen in the constant flow of reported web security issues in bug trackers and vulnerability databases.

Academic web security research has started 2007 and usable security research started almost at the same time. In the context of this Dagstuhl Seminar, we will revisit the lessons learned from the last decade and revisit the success stories and mistakes that have been made. Questions, that have to be raised in include "What has worked?", "What has been taken up by industry?", "What failed and why?", and -- most importantly -- "What did we learn?"

Seminar Objectives

Today, several unconnected groups drive the topic, including Security, Privacy as well as Usable Security & Privacy Academics, standardization, and browser vendors. The seminar will facilitate essential exchange between them. This will allow academia to directly influence browser vendors and standardization representatives, and allow industry representatives to influence the research community.

Overview

Participants

The seminar was well attended with 39 participants. A good balance of European and American researchers was present. Furthermore, the group represented a nice mix of participants of academia and industry. Compared to the previous editions, not only researchers from the web security area participated but also from the field of human factors in security.

Structure

This was the third Dagstuhl seminar on Web application security. The seminar's organisation combined overview presentation of various subfields, highlight talks, and discussions in working groups. In particular the overview presentations were important to connect the two research fields web security from a more technical point of view and human factors in security. This way, also a good, comprehensive view on current activities and open problems in the realm of Web application security in particular from a user's point of view could be achieved and areas for potential future collaborations could be identified.

Talks

The following people presented either an overview of their research field, very recent research results or overarching observations on the field of web application security. Please also refer to Section~ ef{sec:abstracts} for selected talk abstracts.

  • Stefano Calzavara, University of Venezia, IT: REASON - A programmable architecture for secure browsing
  • Luca Compagna, SAP Labs France - Mougins, FR: Analysis & Detection of Authentication Cross-Site Request Forgeries
  • Lieven Desmet, KU Leuven, BE: Detecting and Preventing Malicious Domain Registrations in the .eu TLD
  • Steven Englehardt, Mozilla - Mountain View, US: No Boundaries: Data exfiltration by directly embedded tracking scripts
  • Thomas Gross, Newcastle University, GB: Investigating Cognitive and Affective Predictors Impacting Password Choice
  • Mario Heiderich, Cure53 - Berlin, DE, DOMPurify: Client-Side Protection Against XSS and Markup Injection
  • Boris Hemkemeier, Commerzbank AG - Frankfurt, DE: Web application security in vulnerable environments
  • Martin Johns, TU Braunschweig, DE: WebAppSec @ Dagstuhl - The Third Iteration
  • Christoph Kerschbaumer, Mozilla - San Francisco, US: Could we use Information Flow Tracking to generate more sophisticated blacklists?
  • Pierre Laperdrix, Stony Brook University, US: Browser fingerprinting: current state and possible future
  • Sebastian Lekies, Google Switzerland - Zürich, CH: Trusted Types: Prevent XSS with this one simple trick!
  • Benjamin Livshits, Imperial College London, GB: Browser Extensions for the Web of Value
  • Marius Musch, TU Braunschweig, DE: On measurement studies and reproducibility
  • Lukasz Olejnik, Independent researcher, W3C TAG, FR: Private browsing modes guaranteed. On the example of Payment Request API
  • Juan David Parra, Universität Passau, DE: Computational Resource Abuse through the Browser
  • Giancarlo Pellegrino, Stanford University, US: Removing Browsers from the Equation: A New Direction for Web Application Security
  • Tamara Rezk, INRIA Sophia Antipolis, FR: Content Security Policy Challenges
  • Konrad Rieck, TU Braunschweig, DE: Beyond the Hype: Web Security and Machine Learning?
  • Andrei Sabelfeld, Chalmers University of Technology - Göteborg, SE: A Challenge for Web of Things: Securing IoT Apps
  • Sebastian Schinzel, FH Münster, DE: Handling HTML Emails after the Efail Attacks
  • Zubair Shafiq, University of Iowa - Iowa City, US: The Arms Race between Ad Tech vs. Adblockers: Key Challenges and Opportunities
  • Lynsay Shepherd, Abertay University - Dundee, GB: How to Design Browser Security and Privacy Alerts
  • Dolière Francis Somé, INRIA Sophia Antipolis, FR: The Same Origin Policy and Browser Extensions
  • Ben Stock, CISPA - Saarbrücken, DE: Persistent Client-Side Cross-Site Scripting in the Wild
  • Melanie Volkamer, KIT - Karlsruher Institut für Technologie, DE: Web Security Meets Human Factors in Security
  • Mike West, Google - München, DE: HTTP State Tokens

Conclusions

This seminar was the third Dagstuhl Seminar von Web Application Security, following Seminar 09141 (2009) and Seminar 12401 (2012). Thus, it was a great opportunity to reflect on a decade of web security research. In 2009 the field was largely undefined and that year's seminar offered a wild mix of various topics, some with lasting impact and many that went nowhere. Where the 2009 seminar was overly broad, the 2012 iteration had a comparatively narrow focus as the seminar was dominated by the notion that solving web security mainly revolves around solving the security properties of JavaScript.

This year's seminar reflected the ongoing maturing of the topic very well. Fundamental problems, such as Cross-site Scripting or the Web Browser security model, are well explored and their understanding served as a great foundation for the seminar's discussions. This allowed the extension of the topic toward important facets, such as privacy problems or human factors. While the addressed topics were too broad and the time for overarching discussions was limited due to the three-day format of the seminar, the sparked discussions were fruitful for several follow-up activities (see above). An underlying theme of the seminar can be summarized as "the last decade of web security has broad good progress and development but the overall problem is still neither fully understood nor solved". Especially, the newly introduced dimension of integrating human factors in security, which was reflected through including several high-profile members of this community in the seminar, is still immature.

One of the seminar's prime objectives has been reached very nicely: The fostering of collaboration between the different web security communities. For one, several compelling interactions between practitioners from industry (such as SAP, Commerzbank and Cure53) and researcher from academia took place. Furthermore, thanks to the fact that all major web browser vendors (plus the new privacy-centric browser Brave) were represented at the seminar, both cross-browser vendor interaction as well as browser/academia collaborations were initiated, with the browser-based sanitizer initiative (see breakout session 4.3) being a prominent example.

Copyright Martin Johns, Nick Nikiforakis, Melanie Volkamer, and John Wilander

Participants
  • Frederik Braun (Mozilla - Berlin, DE)
  • Achim D. Brucker (University of Sheffield, GB) [dblp]
  • Stefano Calzavara (University of Venezia, IT) [dblp]
  • Luca Compagna (SAP Labs France - Mougins, FR) [dblp]
  • Lieven Desmet (KU Leuven, BE) [dblp]
  • Steven Englehardt (MOZILLA - Mountain View, US) [dblp]
  • Thomas Gross (Newcastle University, GB) [dblp]
  • Marian Harbach (Audi AG - Ingolstadt, DE) [dblp]
  • Daniel Hausknecht (Chalmers University of Technology - Göteborg, SE) [dblp]
  • John Hazen (Microsoft Corporation - Redmond, US)
  • Mario Heiderich (Cure53 - Berlin, DE) [dblp]
  • Boris Hemkemeier (Commerzbank AG - Frankfurt, DE) [dblp]
  • Martin Johns (TU Braunschweig, DE) [dblp]
  • Christoph Kerschbaumer (Mozilla SECURITY - San Francisco, US) [dblp]
  • Pierre Laperdrix (Stony Brook University, US) [dblp]
  • Sebastian Lekies (Google Switzerland - Zürich, CH) [dblp]
  • Ben Livshits (Imperial College London, GB) [dblp]
  • Matteo Maffei (TU Wien, AT) [dblp]
  • Marius Musch (TU Braunschweig, DE) [dblp]
  • Nick Nikiforakis (Stony Brook University, US) [dblp]
  • Lukasz Olejnik (Independent researcher, W3C TAG, FR) [dblp]
  • Juan David Parra (Universität Passau, DE) [dblp]
  • Giancarlo Pellegrino (Stanford University, US) [dblp]
  • Karen Renaud (University of Abertay - Dundee, GB) [dblp]
  • Tamara Rezk (INRIA Sophia Antipolis, FR) [dblp]
  • Konrad Rieck (TU Braunschweig, DE) [dblp]
  • Andrei Sabelfeld (Chalmers University of Technology - Göteborg, SE) [dblp]
  • Sebastian Schinzel (FH Münster, DE) [dblp]
  • Zubair Shafiq (University of Iowa - Iowa City, US) [dblp]
  • Lynsay Shepherd (Abertay University - Dundee, GB) [dblp]
  • Dolière Francis Somé (INRIA Sophia Antipolis, FR) [dblp]
  • Ben Stock (CISPA - Saarbrücken, DE) [dblp]
  • Daniel Veditz (MOZILLA - Mountain View, US)
  • Melanie Volkamer (KIT - Karlsruher Institut für Technologie, DE) [dblp]
  • Malte Wedel (SAP SE - Walldorf, DE)
  • Rigo Wenning (W3C / ERCIM, FR) [dblp]
  • Mike West (Google - München, DE) [dblp]
  • John Wilander (Apple Computer Inc. - Cupertino, US) [dblp]
  • Henrik Willert (1 & 1 Internet SE - Karlsruhe, DE)

Related Seminars
  • Dagstuhl Seminar 09141: Web Application Security (2009-03-29 - 2009-04-03) (Details)
  • Dagstuhl Seminar 12401: Web Application Security (2012-09-30 - 2012-10-05) (Details)

Classification
  • security / cryptology
  • world wide web / internet

Keywords
  • Web Security