1. 18-jan-962. ETH-W4 (ra)1 security on the Web l security l authentication l privacy

2. 18-jan-962. ETH-W4 (ra)2 security on the Web 1. prevent attacks against Web clients and Web servers 2. guarantee private data exchange two “types” of security:

3. 18-jan-962. ETH-W4 (ra)3 security on the Web l can you trust your browser ? l does your browser allow execution of scripts ? (i’m not talking about Java) l can you trust your helper applications ? threats to your Web client:

4. 18-jan-962. ETH-W4 (ra)4 security on the Web l do not run the httpd as root ! l make sure the script directory is well protected ! l scripts must not allow uncontrolled execution of shell commands ! threats to your Web server:

5. 18-jan-962. ETH-W4 (ra)5 security on the Web l turn off server side includes ! l beware security holes in httpd ! threats to your Web server (cont.):

6. 18-jan-962. ETH-W4 (ra)6 security on the Web l use a bad helper application ! l enter sensitive data ! “non technical” threats: a malicious server may attract your attention and make you

7. 18-jan-962. ETH-W4 (ra)7 authentication on the Web l identify a Web server or Web client l authenticate a buyer who submits an order l identify the author of an important document might be useful to:

8. 18-jan-962. ETH-W4 (ra)8 privacy on the Web l sensitive data is transferred (e.g. a credit card number or a password) might be required, if:

9. 18-jan-962. ETH-W4 (ra)9 more security on the Web l basic authentication l IP based access control l combination of the above simple means to improve security on the Web:

10. 18-jan-962. ETH-W4 (ra)10 more security on the Web l data encryption (U.S. export restrictions apply !) l Pretty Good Privacy (PGP) l secure network layer (SSL, PCT) more sophisticated means to improve security on the Web:

11. 18-jan-962. ETH-W4 (ra)11 more security on the Web l Kerberos based encryption l message digest (public domain !) l smart tokens (PCMCIA cards) more sophisticated means to improve security on the Web (cont.):

12. 18-jan-962. ETH-W4 (ra)12 more security on the Web l U.S export restrictions on encryption algorithms with large keys ! l different approaches (applications with security features vs secure network layer) l reliable key distribution (e.g. PGP) open problems:

13. 18-jan-962. ETH-W4 (ra)13 more security on the Web l there WILL be more security on the Web (commercialization !) l various implementations (e.g. NetScape’s SSL, Microsoft’s PCT) l we might end up with the same problems as with HTML (chaos !) what i expect:

14. 18-jan-962. ETH-W4 (ra)14 security on the Web for more information, see trip report: http://www.ra.ethz.ch/WWW/WWW4/ tutorial_H.html can be found via “ETHZ Web related information” on ezInfo homepage.