UOFilter: A Whitelist-Based Filter for Unintended Objects in Web Pages

A web page often contains objects that the hosted web server intends a browser to render. Rendering those objects can instruct network requests to foreign origins. Although the same origin policy (SOP) limits the access for foreign objects, web attackers could circumvent the SOP controls through injected unintended objects for sensitive data smuggling. In this paper, we propose UOFilter, a whitelist-based method to filter out unintended objects in web pages. We define a list item structure to describe intended objects with optional integrity guarantees. The UOFilter in a web browser interprets the items and blocks the network requests issued by those unintended objects. We implement a proof of concept UOFilter prototype as a chrome browser extension and validate it with experiments.

On Cryptographically Strong Bindings of SAML Assertions to Transport Layer Security

In recent research, two approaches to protect SAML based Federated Identity Management (FIM) against man-in-the-middle attacks have been proposed. One approach is to bind the SAML assertion and the SAML artifact to the public key contained in a TLS client certificate. Another approach is to strengthen the Same Origin Policy of the browser by taking into account the security guarantees TLS gives. This work presents a third approach which is of further interest beyond IDM protocols, especially for mobile devices relying heavily on the security offered by web technologies. By binding the SAML assertion to cryptographically derived values of the TLS session that has been agreed upon between client and the service provider, this approach provides anonymity of the (mobile) browser while allowing Relying Party and Identity Provider to detect the presence of a man-in-the-middle attack.

On Cryptographically Strong Bindings of SAML Assertions to Transport Layer Security

In recent research, two approaches to protect SAML based Federated Identity Management (FIM) against man-in-the-middle attacks have been proposed. One approach is to bind the SAML assertion and the SAML artifact to the public key contained in a TLS client certificate. Another approach is to strengthen the Same Origin Policy of the browser by taking into account the security guarantees TLS gives. This work presents a third approach which is of further interest beyond IDM protocols, especially for mobile devices relying heavily on the security offered by web technologies. By binding the SAML assertion to cryptographically derived values of the TLS session that has been agreed upon between client and the service provider, this approach provides anonymity of the (mobile) browser while allowing Relying Party and Identity Provider to detect the presence of a man-in-the-middle attack.