[...]In fact, HTML5 has security issues of its own. Julien Bellanger, CEO of application security monitoring firm Prevoty, says HTML5 makes security more complex, not simpler. HTML5 security has been a question mark for years, and it has not improved over the stretch, he says.[...]
Among the risks that HTML5 brings, according to Bellanger:
- Canvas image-rendering exploits, which can cause buffer overflows that a hacker could then use to inject code into the session
- Cross-site scripting, where intruders can steal information from a session in the browser
- SQL injection, where a malicious query is used to extract information from a database in the browser
- Cross-site request forgeries, where a user token is taken over to impersonate a user on the Web
The use of HTML5 also exposes more of what's on the computer or mobile device, such as local storage and device location, says Dan Cornell, CTO of cyber security consultancy Denim Group. "Because HTML5 applications can access these facilities, there is an opportunity for abuse," he says.[...]
"The problem we have is that browsers are inherently insecure," says Kevin Johnson, CEO at IT security consulting firm Secure Ideas. For example, HTML5 offers no secure sandboxing protection, such as what Flash can have in the Chrome browser, he notes.
"Another issue we have that we are adding significant complexity to HTML5 without adding the same level of control to the user," Johnson says. At least with Flash, users can turn it off. But they can't turn off HTML.[...]
