~/talk

Chrome Security Secret Sauce

on YouTube 41m
Talkat Strange Loop 2013 · 2013-09-18..09-20· [security, web-platform]

speaker

name:Parisa Tabriz
links:none on file

resources

video:https://youtu.be/mD8xtn0oYeY
slides:none on file

summary

Chrome details concrete defenses: fuzzing with ClusterFuzz on 2,000+ cores to find memory bugs, sandboxing renderer and plugins (native Flash and built‑in PDF sandboxed), automated updates that push patches in under 24 hours, and a vulnerability program now paying $5,000 typical bounties and $60,000 Podium rewards. Safe Browsing classifies malicious pages for over a billion users and exposes an API, and SSL protections include certificate pinning and HSTS whitelists to block real man‑in‑the‑middle incidents.

AI-written summary · about

chapters (30)

  1. 0:00Intro
  2. 0:24Disclaimers
  3. 1:14Chrome's Core Principles
  4. 2:18Chrome Security Team
  5. 3:28Browser Security?
  6. 6:09Top Threats on the Web
  7. 6:33Browser Exploits Malicious code that aims to achieve remote code execution on victim's computer by exploiting a security bug in the browser.
  8. 7:36Counterthreat Step 1: Find and fix security bugs. Update users.
  9. 8:01Find Bugs via Fuzzing
  10. 13:57Pay for Bugs
  11. 16:56Pay for Exploits
  12. 19:23Fix Bugs, Update Users. Fast.
  13. 21:35Defense in Depth
  14. 22:14Process Sandboxing
  15. 23:26Plugin Sandboxing
  16. 24:12Plugin Blocking
  17. 25:37Phishing & Malware Sites Get a user to visit or load a malicious website that either (a) phishes their personal data or (b) delivers some malicious payload leg malware .
  18. 27:33Block Badness
  19. 29:37Find Badness
  20. 30:00Notify of Badness
  21. 31:30Attacks to SSL Violate the security and privacy guarantees of SSL to steal user information
  22. 32:33Gimme some SSL!
  23. 32:56SSL Protocol Handshake
  24. 34:33Man-in-the-Middle Attack
  25. 35:42Certificate Pinning Chrome comes preloaded with the certificates it expects to see for Google-owned websites, and if it does not see one of those when it visits a Google owned website, it shows an error page to the user and will not let the user continue.
  26. 36:44Certificate Pinning FTW!
  27. 37:53HTTP Strict Transport Security
  28. 39:00HSTS Whitelisted Services
  29. 39:40Closing Thoughts Browser security matters. It should be a factor in choosing the software you use.
  30. 40:12Questions? Complaints?

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.