Security Tab Ideas

Suggestions, comments, ideas all welcome on GitHub.

Transport Layer Security

This page was loaded over HTTP.
Organisation Google Inc
Domains www.google.co.uk
google.co.uk
cdn.google.co.uk
Certificate Authority Google Internet Authority G2
Valid from
Valid to

Protocol Details

TLS 1.0, 1.1, 1.2
SSL 2, 3
Key RSA 2048 bits
Revocation information Good CRL, OCSP
Forward Secrecy Good With modern browsers
Next Protocol Negotiation (NPN) Good Yes (spdy/3.1 spdy/3 http/1.1)
Session resumption (caching) Notice No (IDs assigned but not accepted)
Session resumption (tickets) Good Yes
OCSP stapling Good Yes - This reduces the time it takes to load your web page.

Features

  • Certificate information (especially start/end date), in an easy to view format.
  • Protocol versions (e.g. SSLv3 and POODLE).
  • Lists and validates revocation information.
  • Push (or reward) additional features, such as Forward Secrecy, Sessions, OCSP stapling.

Notes

  • Connection select field needs to include overall state (good/notice/error).
  • Connection select field needs to highlight main connection.
  • Connection select field needs to count (or list) the resources using that connection.
  • Possibly link from network tab.
  • Possibly don't display the valid from/to time (shorter).
  • Could include cipher suite used.

Alternatives

  • Chrome

    Chrome Network Tab Mockup 1

    Chrome Network Tab Mockup 2

    A mockup showing an alternative location, with Annotations to highlight possible issues.

    The network tab is request based, where the example shows the first 7 resources using the same connection.

    For auditing purposes, you could use the "Connection ID" column.

  • Firefox

    Firefox Security Panel

    Firefox SHA1 Warning

    Does show certificate information, protocol versions, and promotes the use of HSTS/HPKP.

    Does not list and validate revocation information (CRL/OCSP), or promote additional features (OCSP stapling, TLS sessions, etc).

Certificate Paths

This page was loaded over HTTP.

Certificate packet size: 10,047 bytes.

Path #1 Trusted

1 Good Sent by server - www.google.co.uk Fingerprint: 611ea0807d5dd347435ec0b084304cdbea65df47 RSA 2048 bits (e 65537) / SHA1withRSA Notice WEAK SIGNATURE
2 Good Sent by server - Google Internet Authority G2 Fingerprint: bbdce13e9d537a5229915cb123c7aab0a855e798 RSA 2048 bits (e 65537) / SHA1withRSA Notice WEAK SIGNATURE
3 Notice Extra download (already in trust store) - GeoTrust Global CA Fingerprint: de28f4a4ffe5b92fa3c503d1a349a7f9962a8212 RSA 2048 bits (e 65537) / SHA1withRSA Notice Weak or insecure signature, but no impact on root certificate

Path #2 Trusted

1 Good Sent by server - www.google.co.uk Fingerprint: 611ea0807d5dd347435ec0b084304cdbea65df47 RSA 2048 bits (e 65537) / SHA1withRSA Notice WEAK SIGNATURE
2 Good Sent by server - Google Internet Authority G2 Fingerprint: bbdce13e9d537a5229915cb123c7aab0a855e798 RSA 2048 bits (e 65537) / SHA1withRSA Notice WEAK SIGNATURE
3 Notice Not provided (requires extra download) - GeoTrust Global CA Fingerprint: 7359755c6df9a0abc3060bce369564c8ec4542a3 RSA 2048 bits (e 65537) / SHA1withRSA Notice WEAK SIGNATURE
3 Good In trust store - Equifax / Equifax Secure Certificate Authority Fingerprint: d23209ad23d314232174e40d7f9d62139786633a RSA 1024 bits (e 65537) / SHA1withRSA Notice WEAK KEY IN MOZILLA'S TRUST STORE Notice Weak or insecure signature, but no impact on root certificate

Features

  • Show initial packet size, to help reduce round trips (ideally less than 10KB on a server with an IW10).
  • List paths, fingerprints, etc.
  • Identifies weak signatures (SHA1).
  • Identifies missing intermediate certificates (requiring browser to download separately).
  • Identifies extra root certificate (adding to overall packet size).
  • Help debug connection errors (e.g. accidentally using the intermediate cert for the main cert).

Notes

Alternatives

  • Firefox

    Firefox Security Panel

    Could include these features, but might be too much information?

HTTP Strict Transport Security

This page was loaded over HTTP.

Instructs browsers to always use HTTPS connections.

Good HTTP website does a 301 redirect to HTTPS.

Notice HSTS header not sent (see below).

Notice Not included in this browsers preload list (add).

If you want everyone to connect over HTTPS, include the following header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;

Features

  • Checks HTTP website does a 301 redirect to HTTPS.
  • Checks header was sent.
  • Checks presence in browsers preload list (might not be necessary).
  • Give example header to copy/paste (don't think there is any risk in this, as HTTPS is working).

Notes

Alternatives

  • Firefox

    Firefox Security Panel

    Does show the use of HSTS.

    Does not:

    • Check 301 redirect for a HTTP connection (risk of making too many requests?).
    • Shows if the domain is in the browsers preload list (which won't scale to every website on the internet).
    • Include an example header to use (could be risky having them copy/paste, but probably less so than from a random website).

HTTP Public Key Pinning

This page was loaded over HTTP.

Identifies and blocks invalid certificates for this domain.

Notice HSTS header not sent (setup).

Notice HPKP header not sent.

If you want to limit the valid certificates for your domain, follow the instructions below.

1) Create a backup key (to be used with a CSR later):

openssl genrsa -out "backup.key" 2048;

2) Store this key in a safe place (not on your server).

3) Extract the base-64 encoded SPKI fingerprint:

openssl rsa -in "backup.key" -outform der -pubout |    openssl dgst -sha256 -binary | base64

4) Include the following header (report only mode):

Public-Key-Pins-Report-Only:    pin-sha256="OtJOVJ9HkPkdvrP3WBYf3CLY8dTaf/dmgsI9T4wT9Dw=";    pin-sha256="***Backup Fingerprint***";    max-age=2592000;    includeSubDomains;    report-uri="http://example.com/hpkp-report";

Note: This example pins your current and backup keys for 30 days. Alternatively you could pin the root or intermediate certificates, which might allow you to re-issue a new certificate, but that assumes that your CA will continue to use the same root/intermediate certificate, even if they have a problem.

Features

  • Checks header was sent.
  • Give instructions on how to create a backup key (important).
  • Give example header to copy/paste (current public key is already known, so can be pre-filled).

Notes

  • Should we also complain if missing HSTS?
  • The example sha256 pin "OtJOVJ9H..." can be worked out by the browser.

Alternatives

  • Firefox

    Firefox Security Panel

    Does show the use of HPKP.

    Does not include an example, or warnings about this feature.

Content Security Policy

This page was loaded over HTTP, so the content can be changed!

default-src - 'none' Good Nice one! this is a good default!
style-src - 'self' Good Can you specify a path?
- 'unsafe-inline' Error Can introduce security issues!
- https://*.googleapis.com Good Can you specify a path, and remove wildcard?
font-src - 'self' Good Can you specify a path?
- https://fonts.gstatic.com Notice Not used on this page?
img-src - * Notice Might be a bit permissive?
script-src + 'self' Good Can you specify /a/js/ as a path?
/a/js/jquery-1.11.2.js
/a/js/navigation.js
/a/js/main.js
+ https://www.google-analytics.com Good Can you specify the full url?
https://www.google-analytics.com/analytics.js
+ https://*.googleapis.com Notice Not used on this page.
N/A
- 'unsafe-inline' Error Can introduce security issues!
- 'unsafe-eval' Error Can introduce security issues!
frame-ancestors - 'self' Notice This page isn't in a frame, could it be 'none'?
referrer - no-referrer Good Nice one! this is a good default!
reflected-xss - block Good Nice one! this is a good default!

+ Defaults

base-uri * Limits the <base> href values - used for relative URLs.
child-src 'none' Limits nested browsing contexts (incorporating frame-src)
connect-src 'none' Restricts where connections can be made to (e.g. AJAX requests).
form-action * Restricts where your forms can send data to.
manifest-src 'none' Restricts application manifests can be applied.
media-src 'none' Restricts video, audio, and associated text that can be loaded.
object-src 'none' Restricts plugins that can be loaded.
plugin-types * Restricts plugin types (based on mime type), cannot be 'none'.
report-uri   URL to send error reports to.
sandbox   Applies restrictions based on <iframe> sandbox attribute.

Features

  • If no CSP header was sent, propose one the developer could use.
  • Uses a presentable layout, making it much easier to read than the plain text header, e.g.
    Content-Security-Policy: default-src 'none'; connect-src 'self'; style-src 'self' fonts.googleapis.com 'unsafe-inline' s7.addthis.com; font-src 'self' fonts.gstatic.com; img-src 'self' https://www.google-analytics.com *.disqus.com *.disquscdn.com s7.addthis.com data:; script-src 'self' https://www.google-analytics.com *.disqus.com * disquscdn.com s7.addthis.com 'unsafe-eval'; frame-src disqus.com s7.addthis.com; frame-ancestors 'none'; reflected-xss block;
  • Lists the sources, one per line (did you notice the typo with the disquscdn.com script-src?)
  • Lists the unspecified directives, and what they default to (e.g. form-action).
  • Lists how resources match the sources (identifies unused sources).
  • Identify when resources can match more than one source (e.g. a rouge *).
  • Prompt the developer to be more specific (e.g. all script resources shared a common path).
  • Prompt the developer to avoid 'unsafe-' sources (error or notice? probably ok with nonce/hash).
  • If the developer is using a nonce, perhaps request the page again to see if it changes? risky?
  • Reinforce good decisions.

Notes

  • Errors still shown in the console.
  • In this example the defaults show 'none', because the default-src is set to 'none'.
  • View the CSP2 Spec, or the CSP3 Draft.

Alternatives

  • Chrome

    Chrome Network Tab Mockup 3

    A mockup showing the CSP information (probably no feedback) in the Network tab.

    Either highlight the selected resource, or only show this tab for the HTML documents that specify a CSP header.

Subresource Integrity

This page was loaded over HTTP, so the content can be changed!

https://code.jquery.com/jquery-1.10.2.min.js

ni:///sha-256;C6cv9UyIs9uJeqinPHxthvqh_E1uhG5Twh-Y5qFQmYg?ct=application/javascript

Good https://code.jquery.com/jquery-1.10.2.min.js

https://www.example.com/script.js

ni:///sha-256;asijfiqu4t12eqinPHWTHVqh_E1uhG5Twhakwoeji3W?ct=application/javascript

Good https://www.example.com/script.js

Good https://cdn.example.com/script.js (noncanonical)

http://www.example.com/script.js

ni:///sha-256;asijfiqu4t12eqinPHWTHVqh_E1uhG5Twhakwoeji3W?ct=application/javascript

Good http://www.example.com/script.js

Notice Not advisable, as HTTP requests can be edited on route (e.g. ISP optimisations).

Error Blocked, as HTTPS was used for the main connection (resources must also be encrypted).

https://www.google-analytics.com/analytics.js

Notice No integrity check included.

Features

  • Lists all external resources (probably not from the same domain).
  • Downloads and checks the hash for main and noncanonical resources.
  • Warn developers that ISPs will edit content sent over HTTP (concerns raised by Joel and Chris).

Notes

  • Errors still shown in the console.
  • Ensure developers don't think that loading resources over HTTP, with an integrity check, is acceptable.
  • View the SRI Spec.

Alternatives

  • Chrome

    Chrome Elements Tab Mockup 1

    Could possibly go into the Elements tab, using annotations.

    Does not highlight the problems when using HTTP.

Cross Site Request Forgery

This page was loaded over HTTP, so the content can be changed!

+ Form 1: /admin/account/

Good Does appear to be protected using a hidden field:

  • id = 123
  • action = edit
  • csrf = f3akwau92nma9s

+ Form 2: /admin/account/

Notice Does not appear to include an appropriate hidden field:

  • id = 123
  • action = delete

+ Form 3: /contact/

Notice Does not include any hidden fields.

+ Links:

  • /admin/logout/

Detection is based on the assumption that a hidden field must be present where its value cannot be guessed by another website.

While it is technically possible to protect with the referrer header, it is not recommended.

Features

  • Lists all forms on the page, their action, and any hidden inputs.
  • Next to each field that looks like a CSRF value, include a button to change it, and submit the form.
  • Lists all links on the page, not ideal, but need to reinforce that these can be vulnerable as well.

Notes

  • Reinforce that this is the browser guessing, and you really should test it.
  • Will not identify any CSRF vulnerable links (e.g. a "logout" link).
  • Also note that a browser may prefetch pages, so not use a "delete" link (use a form).

Alternatives

  • Chrome

    Chrome Elements Tab Mockup 1

    Could possibly go into the Elements tab, using annotations.

Cross Site Scripting

This page was loaded over HTTP, so the content can be changed!

Header

Good X-XSS-Protection: 1; mode=block

Content Security Policy

Good reflected-xss = block (review)

This only instructs the browser to look for (and try to block) reflected XSS attacks.

Ideally your website would not have any XSS vulnerabilities anyway.

Features

  • Checks headers were sent.

Notes

  • Reinforce that this is the browser guessing and blocking, not a fix all.

Alternatives

  • Chrome

    Chrome Elements Tab Mockup 1

    Could possibly go into the Elements tab, using annotations.

Framed Content

This page was loaded over HTTP, so the content can be changed!

Header

Notice X-Frame-Options: SAMEORIGIN

Content Security Policy

Notice frame-ancestors = 'self' (review)

As the page isn't loaded in a frame, could it be DENY?

Frames

+ /iframe/

Good Restrictions: 'self' / SAMEORIGIN

Good Sandbox: allow-forms

+ /basket/

Notice Restrictions: Not set, would ideally be "SAMEORIGIN"

Notice Sandbox: Not set, would ideally have some restrictions.

+ https://www.facebook.com/plugins/comments.php

Notice Restrictions: Not set, would ideally be "ALLOW-FROM uri"

Notice Sandbox: Not set, would ideally have some restrictions.

Features

  • Checks headers were sent (i.e. can this page be framed).
  • Prompt the developer to use something more strict (e.g. DENY).
  • Lists each frame/iframe on the page, and show:
    • If they had the appropriate headers sent.
    • If they have the sandbox attribute set.

Notes

Alternatives

  • Chrome

    Chrome Elements Tab Mockup 1

    Could possibly go into the Elements tab, using annotations.

Cookies

This page was loaded over HTTP, so the content can be changed!

  HTTP
Only		 Secure
Only		  
session Good Good  
username Notice Good  
_ga Notice Error
Cookies should be marked as Secure over HTTPS connections (more info)

HTTP Only: Not accessible to JavaScript, and are only sent to/from the server.

Secure Only: Only sent over HTTPS connections.