Web Security

  • confidentiality / privacy
  • data integrity - people shouldn't be messing/updating the wrong data
  • service integrity = your website shouldn't be hi-jacked to do something it's not supposed to do. (availability - denial of service attack = your website is overloaded with bogus requests.)
  • authenticity (you wanna know who you're dealing with)
  • non-repudiation (saying something is different from giving me something signed in writing.)

EVIL TECHNIQUES

  • eavesdropping
  • masquerading - pretending to be someone else (address spoofing)
  • man in the middle / janus: stand in between 2 communicating parties & modify the conversation (must be done in real time)
  • replay: record communication, use data later

Defenses:

  • authentication (establishing your identity to others and vice versa. in web, you need 2-way authentication. web doesn’t have social clues of knowing you’re in target)
  • secrecy
  • you need to know that the public key you have is of target and not of a thief pretending to be target

PUBLIC KEY INFRASTRUCTURE

  • there’s a “certificate authority” that is supposed to introduce you to people
  • this intro can become cumbersome
  • so everyone has a certificate from someone they trust to present another person. i just have to pick someone you trust
  • so client needs a certificate from server before using its public key

  • your browser has a file naming all of the trusted certificate authorities

  • session key established after CA is presented and deal is made.

  • do bulk of communication using symmetric keys - because public key encryption is more expensive. SO both sides agree on DES keys (it's cheaper).

TLS / SSL - transport layer security / secure sockets layer

- https://
- encryption of all content that goes into TCP payload (even the HTTP headers! but that doesn't mean that the TCP headers are encrypted)
- TCP metadata is not encrypted. JUST HTTP STUFF (like an encrypted envelope inside TCP).

Efficiency for Signatures:

  • secure session with unauthenticated, anonymous clients:
  • easy to forge (fine for low-level security... not that effective)

MD5 Hash Algorithm (re-learn this) (cheap functions carefully designed to make it so it's difficult for an attacker)

  • you can't reuse signatures

THIRD PARTY SIGN-ON

  • url encoding
  • can't use cookies