Web Application Security Working Group

Past

Confirmed

Group Meetings

Meeting

Event details

Date:: 23 September 2024, 09:00–12:30 Pacific Daylight Time
Status:: Confirmed
Location:: 2 Ballroom Level - California B
Organizers: Daniel Veditz; Mike West
Groups:: Web Application Security Working Group ( View calendar)
Participants:: Nick Doty, Balazs Engedy, Sasha Firsov, Chris Fredrickson, Matt Gibson, Maxime Guerreiro, Sanket Joshi, Eric Kinnear, Samuel LeDoux, Dibyajyoti Pal, Lucas Pardue, Vincent Scheib, Aaron Shim, Benjamin VanderSloot, Andrew Williams, Rachel Yager
Big meeting:: TPAC 2024 (Calendar)

WIP, still some flexibility based on feedback and availability.

9:00 - 9:15: ☕ and agenda bashing.
9:15 - 9:45: Crypto
- (~15m) Web Crypto (@twiss)
  - Algorithms (modernizing, post-modernizing)
  - Curve 25591
  - Streaming
  - Feature Detection
- (~15m) Remote cryptokeys (@marcoscaceres, @estark37)
9:45 - 10:30: Application Integrity/Transparency (@ddworken)
- (~25m) Extensions to SRI
  - Additional content types
  - Additional assertion types (signatures, etc))
  - require-sri-for (@yoavweiss)
- (~20m) Signing / Packaging
10:30 - 11:00: ☕ & 🍰 @ Lanai Deck, Fifth Floor
11:00 - 12:00: CSP
- (~15m) Should the threat model include exfiltration? (@yoavweiss)
- (~20m) How can we improve adoption? (@simoneonofri, @johnwilander)
  - Docs & recommendations?
  - CSP Next?
- (~15m) Could we require injection mitigation for interesting APIs? (@mikewest)
- (~10m) What's left before putting CSP into "living CR" mode?
12:00 - 12:10: https://github.com/w3c/webappsec-permissions-policy/issues/273 (@sanketj)
12:10 - 12:30: Breakout pitch session. There are a number of breakout sessions (grid, details) on 25.09.2024 that are relevant to this community. Let's talk about them a bit so folks can plan accordingly.

Please log in to export this event with all the information you have access to.

The following links do not contain any sensitive information and can be shared publicly.

Report feedback and issues on GitHub.