Home | english  | Impressum | Datenschutz | Sitemap | KIT

KIT Campus Süd
Kollegiengebäude am Kronenplatz (Geb. 05.20)
Kaiserstr. 89
76133 Karlsruhe


Newsletter abbonieren
YouTube abonnieren

Montag, 24. Aug 2020
ARES 2020
Dienstag, 06. Okt 2020
Fifth International Joint Conference on Electronic Voting
Freitag, 23. Okt 2020
AIK Symposium Cybersicherheit

Weitere Veranstaltungen...
Externe Veranstaltungen
Dienstag, 17. Mär 2020
Samstag, 25. Apr 2020
CHI 2020
Dienstag, 26. Mai 2020

Weitere Veranstaltungen...


Karlsruher IT-Sicherheitsinitiative

Weitere SECUSO Veranstaltungen

Auf dieser Seite finden Sie alle Veranstaltungen, die wir aktiv (mit-)organisieren. Darüber hinaus sind wir Teil des Organisationsteams der halbjährlichen E-Voting PhD Kolloquium.

Dagstuhl-Seminar "Web Application Security"
Schloss Dagstuhl


Melanie Volkamer (TU Darmstadt, DE / Karlstad University, SE)
Martin Johns (SAP SE – Karlsruhe, DE)
Nick Nikiforakis (Stony Brook University, US)
John Wilander (Apple Computer Inc. – Cupertino, US)


Since its birth in 1990, the Web has evolved from a simple, stateless delivery mechanism for static hypertext documents to a fully-fledged run-time environment for distributed, multi-party applications. Even today, there is still a continuous demand for new features and capabilities which drives the Web’s evolution onwards. This unplanned and often chaotic development has led to several deeply ingrained security and privacy problems that plague the platform:

  • The Web’s original hypertext, multi-origin nature which is manifested in the design of HTML and HTTP is in fundamental conflict with JavaScript’s Same-Origin Policy, the Web’s most important security mechanism.
  • Important security properties, such as end-to-end communication security or endpoint identity are outside of the control of the actual applications. Instead, they depend on the security of external entities, such as domain name servers or certificate authorities.
  • Data/code separation in web applications is practically infeasible, as the HTTP link between server-side application logic and client-side application interface requires an intermixing of protocol, data and code fragments within a single continuous character stream.
  • HTTP is a stateless protocol without a native session or authentication tracking concept.
  • Users are not aware of general or application specific threats. Protecting against these threats (incl. to know which security indicators to trust) is nowadays difficult and time consuming.

Using this fragile basis, critical applications are created, that long have left the strict client-server paradigm, on which the Web was initially built. Instead, scenarios are realized that involve several mutually distrusting entities in a single security and application context. In many cases the browser is the link that connects the remote parties, either via direct JavaScript inclusion, web mashups, or through the usage of web protocols, such as OpenID and OAuth.

The accumulated ballast of the last two decades of web evolution, the ever growing functional demands of sophisticated web applications and the ambitious vision of the web platform’s drivers creates an exciting tension field which is in constant conflict with the required security assurances of high value business applications.

Since approximately ten years, academic security and privacy research has recognized the importance of the web platform and the unique characteristics and challenges of the web security and privacy topic. And while specific techniques, that originated from academic research, such as the Content Security Policy, have been adapted in practice, the fundamental security problems of the web remain and the overall vulnerability landscape is getting worse, as it can be seen in the constant flow of reported web security issues in bug trackers and vulnerability databases.

Academic web security research has started 2007 and usable security research started almost at the same time. In the context of this Dagstuhl Seminar, we will revisit the lessons learned from the last decade and revisit the success stories and mistakes that have been made. Questions, that have to be raised in include “What has worked?”, “What has been taken up by industry?”, “What failed and why?”, and – most importantly – ”What did we learn?”

Today, several unconnected groups drive the topic, including Security, Privacy as well as Usable Security & Privacy Academics, standardization, and browser vendors. The seminar will facilitate essential exchange between them. This will allow academia to directly influence browser vendors and standardization representatives, and allow industry representatives to influence the research community.

Neue Veranstaltung für Kalender vorschlagen