Abusing Bleeding Edge Web Standards for Appsec Glory

Explore the risks and mitigation strategies associated with modern web security standards in this 43-minute Black Hat conference talk. Delve into the complexities of implementing SubResource Integrity (SRI), Content Security Policy (CSP), and HTTP Public Key Pinning (HPKP) in legacy applications. Examine the trade-offs between adopting cutting-edge standards and accepting existing risks. Learn effective compromise strategies to make these standards more accessible for builders and defenders. Discover emergent properties of standards like HPKP and their unforeseen applications. Gain insights into exploiting vulnerabilities in volatile standards, including recently uncovered issues. Presented by Bryant Zadegan and Ryan Lester, this talk offers valuable knowledge for both defenders and breakers in the web application security landscape.