Browser Security in 2017
summary
HTTP page loads fall from almost 60% to just under 50% after browsers start flagging insecure sites and Firefox 52 warning labels login fields as “could be compromised”; HSTS prevents SSL‑strip attacks, Let’s Encrypt removes certificate cost barriers, and mixed passive content can leak cookie headers so drop HTTP images or block them. Use subresource integrity for CDN scripts, enable CSP with report‑uri to collect violations, and follow the Permissions API patterns to avoid abusive permission prompts.
AI-written summary · about
chapters (10)
- 0:00Firefox vs insecure HTTP logins
- 2:30Browser warnings for insecure elements
- 4:20Mixed content risks and blocks
- 7:14HTTPS non-negotiable for sites
- 8:40Securing web content with policies
- 11:50XSS and Content Security Policy
- 14:42Verifying third-party content integrity
- 16:28Securing device API access
- 23:56Preventing abusive permission prompts
- 27:08Browser security best practices
related talks
59mThe Final Frontier: Security APIs in Modern Browsers
43mRestricting the scripts, you're ...
51mWeb Platform: The Secure Parts
19mWeb Platform Security
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
31mHTTP Security Headers: A Technology History Through Scar Tissue
55mWeb Application Security: Browsers Fight Back!
43mEmerging Web Security Standards