Trusted Types: End to end injection safety at scale   KRZYSZTOF KOTOWICZ  MIKE SAMUEL
Channel: OWASP Foundation
Date: 2019-07-05

OWASP Global AppSec Tel Aviv
https://telaviv.appsecglobal.org/

18 years have passed since Cross-Site Scripting (XSS) became the single most common security problem in web applications. Since then, numerous efforts have been proposed to detect, fix or mitigate it, but these piecemeal efforts have not combined to make it easy to produce XSS-free code.

This talk explains how Google’s security team has achieved a high-level of safety against XSS and related problems by integrating tools to make it easier for developers to easier to produce secure software than vulnerable, and to bound the portion of a code base that could contribute to a vulnerability.

We will show how this works in practice and end with advice on how to achieve the same results on widely-used, open-source stacks and new browser mechanisms that will make it much easier to achieve high-levels of security with good developer experience.

Krzysztof Kotowicz
Senior Software Engineer, Information Security Engineering team, Google
Krzysztof Kotowicz is a web security researcher specializing in discovery and exploitation of client-side vulnerabilities, and a software engineer in the Information Security Engineering team at Google. 

Mike Samuel
Software Engineer, Google, Inc.
Mike Samuel works on Google's technical infrastructure team improving  libraries and programming languages to make it easier to produce  secure & robust software.    Mike has worked on JavaScript sandboxing, the Secure EcmaScript and  other language committee proposals.

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project