DEF CON 32 - Securing Frontends at Scale;Paving our Way to Post XSS World - jen ozmen, Aaron Shim
Source: YouTube · DEFCONConference · published Oct 16, 2024 · 24:41
The video outlines how Google mitigates cross-site scripting (XSS) using Content Security Policy (CSP) and Trusted Types, emphasizing developer-friendly, framework-integrated security that reduces vulnerabilities at scale and envisions a future where unsafe DOM APIs are banned in favor of safer, platform-level alternatives—known as "Perfect Types."
Key Takeaways:
• XSS is a major web security issue, with over 35% of reported vulnerabilities at Google being XSS, and it occurs when user input is interpreted as code in dynamic HTML 1:43.
• CSP mitigations like "nonce-only" and "hash-based" policies block unauthorized scripts by allowing only trusted sources, with nonce-only requiring per-request randomness and hash-based offering fixed, static protection for static sites 3:08-4:18.
• Trusted Types prevents DOM-based XSS by restricting dangerous APIs (like innerHTML) and requiring typed objects (e.g., Trusted Types) instead of strings, with tools like DOMPurify automating safe sanitization 9:00-11:28.
• Google advocates shifting security left—implementing CSP and Trusted Types early in development via dev servers or static HTML transformations—using tools like a GitHub/NPM plugin to automate CSP hashing and refactoring 16:08-17:50.
• Static analysis tools like Safety Web detect unsafe API calls and suggest safe refactors using libraries like Safe Values to enforce trusted inputs via TypeScript 19:32-20:13.
• Third-party dependencies are a major challenge for CSP and Trusted Types adoption, as they may violate policies; Google is developing tools to assess compatibility and encourages community contributions to fix such issues [20:40-21:07](https://www.youtube.com/watch?v=vEzLsRX
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello my name is Aaron and um I guess I have to apologize the resemblance is a real a little hard to see in that picture um because my hair is not nearly as luscious as it is in that photo but I'm sorry your mineral content in the water as you've all found out really awful here but yeah like Jen um I work at uh Google um we do web Security on hundreds and thousands of different web apps I've been at Google for a little under 7even years and before my stint in security I came from the developer site I've worked on products like Google Docs and uh gcp on customer facing stuff so uh when we approach this work of trying to make our web apps as secure as possible we approach it with a special empathy for the developer where we want to ship the most uh secure products but also we don't want to g…