Since its birth in 1990, the Web has evolved from a simple, stateless delivery mechanism for static hypertext documents to a fully-fledged run-time environment for distributed, multi-party applications. Even today, there is still a continuous demand for new features and capabilities which drives the Web’s evolution onwards. This unplanned and often chaotic development has led to several deeply ingrained security and privacy problems that plague the platform:

• The Web’s original hypertext, multi-origin nature which is manifested in the design of HTML and HTTP is in fundamental conflict with JavaScript’s Same-Origin Policy, the Web’s most important security mechanism.
• Important security properties, such as end-to-end communication security or endpoint identity are outside of the control of the actual applications. Instead, they depend on the security of external entities, such as domain name servers or certificate authorities.
• Data/code separation in web applications is practically infeasible, as the HTTP link between server-side application logic and client-side application interface requires an intermixing of protocol, data and code fragments within a single continuous character stream.
• HTTP is a stateless protocol without a native session or authentication tracking concept.
• Users are not aware of general or application specific threats. Protecting against these threats (incl. to know which security indicators to trust) is nowadays difficult and time consuming.

Using this fragile basis, critical applications are created, that long have left the strict client-server paradigm, on which the Web was initially built. Instead, scenarios are realized that involve several mutually distrusting entities in a single security and application context. In many cases the browser is the link that connects the remote parties, either via direct JavaScript inclusion, web mashups, or through the usage of web protocols, such as OpenID and OAuth.

The accumulated ballast of the last two decades of web evolution, the ever growing functional demands of sophisticated web applications and the ambitious vision of the web platform’s drivers creates an exciting tension field which is in constant conflict with the required security assurances of high value business applications.

Since approximately ten years, academic security and privacy research has recognized the importance of the web platform and the unique characteristics and challenges of the web security and privacy topic. And while specific techniques, that originated from academic research, such as the Content Security Policy, have been adapted in practice, the fundamental security problems of the web remain and the overall vulnerability landscape is getting worse, as it can be seen in the constant flow of reported web security issues in bug trackers and vulnerability databases.

Academic web security research has started 2007 and usable security research started almost at the same time. In the context of this Dagstuhl Seminar, we will revisit the lessons learned from the last decade and revisit the success stories and mistakes that have been made. Questions, that have to be raised in include “What has worked?”, “What has been taken up by industry?”, “What failed and why?”, and – most importantly – ”What did we learn?”

Today, several unconnected groups drive the topic, including Security, Privacy as well as Usable Security & Privacy Academics, standardization, and browser vendors. The seminar will facilitate essential exchange between them. This will allow academia to directly influence browser vendors and standardization representatives, and allow industry representatives to influence the research community.

Creative Commons BY 3.0 DE

Martin Johns, Nick Nikiforakis, Melanie Volkamer, and John Wilander

• Frederik Braun (Mozilla - Berlin, DE)
• Achim D. Brucker (University of Sheffield, GB) [dblp]
• Stefano Calzavara (University of Venezia, IT) [dblp]
• Luca Compagna (SAP Labs France - Mougins, FR) [dblp]
• Lieven Desmet (KU Leuven, BE) [dblp]
• Steven Englehardt (MOZILLA - Mountain View, US) [dblp]
• Thomas Gross (Newcastle University, GB) [dblp]
• Marian Harbach (Audi AG - Ingolstadt, DE) [dblp]
• Daniel Hausknecht (Chalmers University of Technology - Göteborg, SE) [dblp]
• John Hazen (Microsoft Corporation - Redmond, US)
• Mario Heiderich (Cure53 - Berlin, DE) [dblp]
• Boris Hemkemeier (Commerzbank AG - Frankfurt, DE) [dblp]
• Martin Johns (TU Braunschweig, DE) [dblp]
• Christoph Kerschbaumer (Mozilla SECURITY - San Francisco, US) [dblp]
• Pierre Laperdrix (Stony Brook University, US) [dblp]
• Sebastian Lekies (Google Switzerland - Zürich, CH) [dblp]
• Ben Livshits (Imperial College London, GB) [dblp]
• Matteo Maffei (TU Wien, AT) [dblp]
• Marius Musch (TU Braunschweig, DE) [dblp]
• Nick Nikiforakis (Stony Brook University, US) [dblp]
• Lukasz Olejnik (Independent researcher, W3C TAG, FR) [dblp]
• Juan David Parra (Universität Passau, DE) [dblp]
• Giancarlo Pellegrino (Stanford University, US) [dblp]
• Karen Renaud (University of Abertay - Dundee, GB) [dblp]
• Tamara Rezk (INRIA Sophia Antipolis, FR) [dblp]
• Konrad Rieck (TU Braunschweig, DE) [dblp]
• Andrei Sabelfeld (Chalmers University of Technology - Göteborg, SE) [dblp]
• Sebastian Schinzel (FH Münster, DE) [dblp]
• Zubair Shafiq (University of Iowa - Iowa City, US) [dblp]
• Lynsay Shepherd (Abertay University - Dundee, GB) [dblp]
• Dolière Francis Somé (INRIA Sophia Antipolis, FR) [dblp]
• Ben Stock (CISPA - Saarbrücken, DE) [dblp]
• Daniel Veditz (MOZILLA - Mountain View, US)
• Melanie Volkamer (KIT - Karlsruher Institut für Technologie, DE) [dblp]
• Malte Wedel (SAP SE - Walldorf, DE)
• Rigo Wenning (W3C / ERCIM, FR) [dblp]
• Mike West (Google - München, DE) [dblp]
• John Wilander (Apple Computer Inc. - Cupertino, US) [dblp]
• Henrik Willert (1 & 1 Internet SE - Karlsruhe, DE)