bugtraq - Browser Security Handbook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 11 Dec 2008 00:05:06 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.cc>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Browser Security Handbook

Hi all,

I am happy to announce the availability of our "Browser Security Handbook" 
- a comprehensive, 60-page document meant to provide web application 
developers and information security researchers with a one-stop reference 
to several hundred key security properties and sometimes counterintuitive 
quirks in contemporary web browsers:

   http://code.google.com/p/browsersec/wiki/Main

Having a clear picture of these characteristics appears to be of 
significance to building secure web applications, and to auditing existing 
designs for potential weaknesses. For this reason, I am hoping that the 
document is a valuable contribution to the information security community.

BSH currently covers recent releases of Microsoft Internet Explorer 
(versions 6 and 7), Mozilla Firefox (versions 2 and 3), Apple Safari, 
Opera, Google Chrome, Android embedded browser, and a handful of browser 
plugins.

Please note that due to the sheer number of characteristics covered, I 
fully expect some kinks to show up here and there; feedback from vendors 
and security researchers is greatly appreciated.

Cheers,
/mz