Now you can trust the browser
summary
Claim: browser code can be made trustworthy enough to stop many MITM and tampering attacks by combining white-box cryptography, strong obfuscation and continuous diversification. Implementation: a JS pipeline compiles white-box AES into obfuscated JS, serves many diversified instances from CDN (ten thousand-ish), adds ~170 KB gzipped, and detects debugging or DOM tampering. Surprising metric: Firefox research finds 10–18% of updates see MITM. Demo: a protected ecommerce checkout survives TLS stripping and flags tampering in real time.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:30The Internet
- 2:50The Brick Wall
- 3:40SSL
- 6:00Man in the middle
- 8:50Demo
- 11:35Escape
- 13:30Trust
- 15:00Your browser
- 15:15A verifier
- 16:45Whitebox cryptography
- 18:15Diversification
- 20:10Whitebox
- 23:25Diversity
- 27:20Real world examples
related talks
11mWhat your browser can teach you about software security
55mWeb Application Security: Browsers Fight Back!
40mHostile JavaScript: Attacking and Defending the Browser
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
59mThe Final Frontier: Security APIs in Modern Browsers
42mThe Perilous Future of Browser Security
39mWeb Cryptography
52mBreaking Fraud and Bot Detection Solutions