CS4241: Webware Class 25: A Few Short Topics Web Security 1 Copyright , Michael J. Ciaraldi

2 Favicon

3  An icon for a Web site, displayed o On the address bar. o With the bookmark.  Supported by many browsers. o Internet Explorer o Mozilla / Firefox o Opera o Not Lynx  For an intro: o

4 Using Favicon  Browser looks for image file favicon.ico o First in same directory as Web page. o Next in site’s home directory.  Can also request a specific icon. o Put this tag in the of the page: 

5 Making a Favicon  Must be an icon (.ico) file. o 16 x 16 pixels for menu. o 32 x 32 pixels for “large icon” view.  Will be scaled if necessary. o Both can be in the same file.  Many free icon editors. o resourceeditors.shtml resourceeditors.shtml o I used IconSuite.

6 Opening Other Pages & Passing Data to Them

7 Opening Other Pages  Tutorial: o vascript/article.php/ /So-You- Want-To-Open-A-Window-Huh.htm vascript/article.php/ /So-You- Want-To-Open-A-Window-Huh.htm o Use window.open(…) o You can create objects and functions, then pass them to the JavaScript in the other window.

8 Passing Data to Other Pages  An interesting example: o alendarpopup alendarpopup o Pops up a calendar in a new window. o Selected date returned to original window. var cal1 = new CalendarPopup(); cal1.select(inputObject, anchorname, dateformat);

9 Security

10 Security  Need for Security  Where security is implemented  Encryption  Network security  Virtual Private Networks

11 Need for Security  Isn’t it obvious?  Deliberate and accidental threats.  Consequences: o Lost or altered information. o Revealed information. o Financial loss. o Embarrassment.

12 Where is Security Implemented?  Within servers o Standard stuff  LAN / Wireless o Access control o Encryption  Along the Internet o Encryption

13 Network Security  Encryption (communications)  Authentication.  Access control.

14 Access Control  LAN o MAC address registration o User authentication  Wireless o As above o WEP / WPA

15 Encryption  Encryption algorithms o DES, Triple-DES o RSA o AES  Key length  Key systems

16 Key Systems  Public vs. Private  Symmetric vs. Asymmetric  Shared vs. Public  Public

17 Shared Key  One key shared between sender and receiver.  How to share it securely?  How to store it securely?  How to manage multiple communication partners?

18 Public / Private Key  Every entity has two keys, public and private.  Both needed to encrypt / decrypt.  Neither can be derived from the other.  PKI = Public Key Infrastructure

19 Using Public Key System  To send: o Encrypt with the recipient’s public key. o Recipient decrypts with his private key.  Alternative: o Encrypt with sender’s private key. o Recipient decrypts with sender’s public key.  Or both!  Which one guarantees what?

20 Authentication  Shared key  Public / private  Message digest / digital signature o Faster than complete encryption.  Are you sure public keys are valid?  Digital certificates o Hold public keys. o Can you trust them? o Can be revoked.

21 Network Communications Security  Physical  IPSEC  SSL

22 Physical Security  Pretty hard to be absolutely sure. o Wiretap o Hubs vs. Switches o Fiber optic  Extreme measures.

23 IPSEC  Based on PKI.  Must be in the kernel.  Standard in IPv6.  Optional in IPv4.  Adds headers, wraps packets.  Provides encryption and authentication.  Can disrupt traffic shaping.

24 IPSEC  Based on PKI.  Must be in the kernel.  Standard in IPv6.  Optional in IPv4.  Adds headers, wraps packets.  Provides encryption and authentication.  Can disrupt traffic shaping.

25 SSL  Secure Socket Layer  Based on PKI / Certificates  Operates above the OS. Why? o In the Web server o In the client

26 VPN  Virtual Private Network  Can be based on public or private keys.  Intercepts and tunnels packets based on address.  Can extend the LAN.

And Then There’s Cyberwar  Easiest: o DOS & DDOS.  Domain server hijacking.  Hijacking traffic by changing routing tables. 27

Next Times  Tuesday: Final Exam  Thursday: Future of the Web 28