Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Security 101 - Ruby Fun Day 2014

Avatar for Francesco Rodríguez Francesco Rodríguez
October 23, 2014
Programming
0
110

Web Security 101 - Ruby Fun Day 2014

In this workshop you will learn about the basics of web security by starting with a clean application and adding features to prevent the most common attacks.
Avatar for Francesco Rodríguez

Francesco Rodríguez

October 23, 2014
Tweet

More Decks by Francesco Rodríguez

See All by Francesco Rodríguez
A Minimalistic Ruby Stack
Avatar for Francesco Rodríguez frodsan
1
54
Web Development with Cuba - Ruby Fun Day 2014
Avatar for Francesco Rodríguez frodsan
0
110
Introduction to Cuba
Avatar for Francesco Rodríguez frodsan
1
53
Aprende a Programar
Avatar for Francesco Rodríguez frodsan
0
160
Metaprogramming: From Zero to Hero. (URU meetup)
Avatar for Francesco Rodríguez frodsan
1
120
Introducción a Cuba
Avatar for Francesco Rodríguez frodsan
0
72

Other Decks in Programming

See All in Programming
AI時代の開発者評価について
Avatar for Ayuusu ayumuu
0
230
generative-ai-use-cases(GenU)の推しポイント ～2025年4月版～
Avatar for Hideyuki Nagata hideg
1
380
Boost Your Performance and Developer Productivity with Jakarta EE 11
Avatar for ivargrimstad ivargrimstad
0
810
2025-04-25 GitHub Copilot Agent ライブデモ（スクリプト）
Avatar for GOAMI Takaaki goataka
0
110
Improve my own Ruby
Avatar for monochrome sisshiki1969
0
100
Dissecting and Reconstructing Ruby Syntactic Structures
Avatar for ydah ydah
3
2.1k
KawaiiLT 登壇資料　キャリアとモチベーション
Avatar for 柊 hiiragi
0
160
M5UnitUnified 最新動向 2025/05
Avatar for GOB gob
0
130
ComposeでWebアプリを作る技術
Avatar for てべすてん tbsten
0
130
「理解」を重視したAI活用開発
Avatar for FastDOCTOR fast_doctor
0
280
AIコーディングの理想と現実
Avatar for Tomohisa Takaoka tomohisa
35
37k
AWS Summit Hong Kong 2025: Reinventing Programming - How AI Transforms Our Enterprise Coding Approach
Avatar for Ernest Chiang dwchiang
0
130

Featured

See All Featured
The Language of Interfaces
Avatar for Des Traynor destraynor
158
25k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
273
40k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.3k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
8
700
KATA
Avatar for Megan Lloyd mclloyd
29
14k
Side Projects
Avatar for Sacha Greif sachag
453
42k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
54
5.5k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
160
15k
Building an army of robots
Avatar for Kyle Neath kneath
305
45k
Facilitating Awesome Meetings
Avatar for Lara Hogan lara
54
6.3k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
227
22k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
462
33k

Transcript

  1. None

  2. Francesco (frodsan) [email protected]

  3. Web Security 101

  4. Passwords

  5. How not to!

  6. #1 Just store it!

  7. None
  8. None
  9. None
  10. None

  11. #2 Encryption

  12. None
  13. None
  14. None
  15. None
  16. None
  17. None
  18. None
  19. None

  20. Encryption is reversible

  21. DES 3DES AES

  22. #3 Hashing

  23. Hashing is irreversible

  24. hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44”

  25. hash(?) “e10adc3949ba59abbe56e057f20f883e”

  26. Hashing is deterministic

  27. hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44” ! hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44”

  28. hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44” ! hash(“mupassword”) “b11d7ccaee763e5840f9d906e0bf2edf”

  29. None
  30. None
  31. None

  32. Hashing is deterministic

  33. hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44” ! hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44”

  34. thelonelyones.heroku.com/passwords.csv
 thelonelyones.heroku.com/login Exercise

  35. Lookup tables

  36. None

  37. Adobe Security Breach (2013) 38 million active users
 passwords, credit

    card information

  38. http://xkcd.com/1286/

  39. MD5
 SHA1 SHA2

  40. ✓ Hashing + Salting

  41. hash(“mypassword”) “34819d7beeabb9260a5c854bc85b3e44”

  42. hash(“mypassword”, salt)

  43. hash(“mypassword”, e8ed4834c7dd0…) “21b9558e8920bddb04949c068181c…”

  44. hash(“mypassword”, e8ed4834c7dd0…) “21b9558e8920bddb04949c068181c…
 
 hash(“mypassword”, 1bc1fa3bc1d5d85…)
 e92a46f76d413ce73ab5796756bc92…

  45. 1976 - crypt(3)

  46. GPU
 FPGA

  47. PBKDF2
 Bcrypt Scrypt

  48. PBKDF2 (armor, pbkdf2)
 Bcrypt (bcrypt) Scrypt (scrypt)

  49. How to do it

  50. ʕ•ᴥ•ʔ ! • Don’t do it (leave it to GitHub,

    Google, etc.) • If you must do it, use pbkdf2 or bcrypt or scrypt. • Keep password length between 8 and 50. • Nothing can save you easy to guess passwords.

  51. Cross Site Scripting - XSS

  52. 1993

  53. <HTML/>

  54. <html> ! </html>

  55. <html> <b>Web Security 101</b> </html>

  56. None

  57. </>?

  58. Escaping

  59. <html> <b>Angle brackets: &gt; &lt;</b> </html>

  60. None

  61. 1995

  62. JavaScript

  63. <html> ! </html>

  64. <html> <script>
 </script> </html>

  65. <html> <script> var message = "Web Security 101"; ! alert(message);

    </script> </html>
  66. None

  67. <html> <script> var message = "<b>Web Security 101</b>"; ! document.write(message);

    </script> </html>
  68. None

  69. JavaScript == DANGER

  70. None

  71. “Samy is my hero” (2005) • XSS attack propagated by

    Myspace profiles. ! • Over one million affected users within the first 20 hours. ! • 3 years without computer.

  72. How to do it

  73. Escaping

  74. UNSAFE = /[&"'><\/]/ ! HTML_ESCAPE = { "&" => "&amp;",

    ">" => "&gt;", "<" => "&lt;", '"' => "&quot;", "'" => "&#x27;", "/" => "&#x2F;" } ! string.gsub(UNSAFE, HTML_ESCAPE)

  75. UNSAFE = /[&"'><\/]/ ! HTML_ESCAPE = { "&" => "&amp;",

    ">" => "&gt;", "<" => "&lt;", '"' => "&quot;", "'" => "&#x27;", "/" => "&#x2F;" } ! string.gsub(UNSAFE, HTML_ESCAPE)

  76. github.com/frodsan/hache

  77. References

  78. • OWASP Top 10:
 https://www.owasp.org
 
 • Adobe 10GB database

    passwords leak:
 http://bit.ly/188ctZL
 • MySpace XSS vulnerability:
 http://bit.ly/1urMIbG
 • Tweetdeck XSS vulnerability:
 http://bit.ly/1urMGAy


  79. thanks ʕ•ᴥ•ʔ