Web App Manifest - Revision history

Tom: /* References */

2022-04-08T17:05:26Z

‎References

Tom: /* References */

2020-11-22T04:34:20Z

‎References

Tom: /* Solutions */

2019-05-15T20:28:29Z

‎Solutions

Tom: /* Solutions */

2019-05-15T16:05:47Z

‎Solutions

Tom: /* Solutions */

2019-05-15T16:03:28Z

‎Solutions

Tom: /* Solutions */

2019-05-15T15:51:47Z

‎Solutions

Tom: /* Problems */

2019-05-15T15:50:57Z

‎Problems

Tom: /* Problems */

2019-05-15T15:50:21Z

‎Problems

Tom: /* Solutions */

2019-05-11T19:01:46Z

‎Solutions

Tom: Created page with "==Full Title and Meme== A structure that can be linked to by a web page to enable the browser to create a link to the Web App that looks like a Native App. ==Context=..."

2019-05-09T01:57:06Z

Created page with "==Full Title and Meme== A structure that can be linked to by a web page to enable the browser to create a link to the Web App that looks like a Native App. ==Context=..."

New page

==Full Title and Meme==
A structure that can be linked to by a web page to enable the browser to create a link to the [[Web App]] that looks like a [[Native App]].

==Context==
* The day when a personal computer was for running application for the user is long gone, never to return.
* Today a personal computer depends on cloud based service for nearly all of its functionality.
* Web Site security is becoming widely known as Cyber-Security, probably because that sounds more important somehow.
* This page will only consider the use of a trusted [[User Agent]], typically a web browser from a well-known and trusted vendor.
* For the case of the user allowing a [[Native App]] to be installed on their personal device, see the page [[Native App Security]].

==Problems==
* After 20 years of web based attacks on users, security protection is still dependent on the education of users, who are known to be gullible. This is a 2018-12 report from the NSS<ref>NSSlabs, ''NSS Labs Announces Results of 2018 Web Browser Security Test.'' (2018-12-05) https://globenewswire.com/news-release/2018/12/05/1662619/0/en/NSS-Labs-Announces-Results-of-2018-Web-Browser-Security-Test.html</ref>
<blockquote>Education is a key component of protection against SEM [socially engineered malware] and phishing attacks. Users who are able to identify socially engineered attacks rely less on technology for protection against such attacks. NSS Labs recommends supplementing browser protection with user education to protect against attacks that bypass browser protections.</blockquote>
* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded secure content]. On 2019-05-08 Chrome browser (currently version 74) was just announcing (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite of its appearance as section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which version of Chrome might have this feature.

==Solutions==
These are proposed on 2019-05-08 for a future release:
* The [[Web Site]] exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on [[Trusted Identifier]] and [[Web Site Identity]] for details.
* Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.

==References==
===Organizational Support===
# [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
# [https://www.nationalisacs.org/ ISAC]s are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators.

[[Category:Glossary]]
[[Category:Security]]

← Older revision		Revision as of 17:05, 8 April 2022
Line 32:		Line 32:
	[[Category:Glossary]]		[[Category:Glossary]]
	[[Category:Security]]		[[Category:Security]]
		+	[[Category: Web]]

@@ Line 24: / Line 24: @@
 ==References==
 ===Organizational Support===
-# [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
+* [https://github.com/w3c/manifest-app-info/issues manifest-ap-info on GitHub]. In particular there are issues posted here.
-# [https://www.nationalisacs.org/ ISAC]s are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators.
+* [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
 [[Category:Glossary]]
 [[Category:Security]]

@@ Line 20: / Line 20: @@
 * The [[Web Site]] exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on [[Trusted Identifier]] and [[Web Site Identity]] for details.
 * Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.
 * The [[Web App Manifest]] is required of a [[Progressive Web App]] among other features.

@@ Line 16: / Line 16: @@
 ==Solutions==
 These are proposed on 2019-05-08 for a future release:
-* The [https://www.w3.org/TR/appmanifest/ current spec] of the [[Web App Manifest ]] is available on GitHub.
+* The [https://www.w3.org/TR/appmanifest/ current spec] of the [[Web App Manifest]] is available on GitHub.
 * The [https://github.com/w3c/manifest/blob/gh-pages/explainer.md Explainer] does a good job of defining the purpose and scope of the manifest.
 * The [[Web Site]] exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on [[Trusted Identifier]] and [[Web Site Identity]] for details.
 * Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.
 ==References==

@@ Line 12: / Line 12: @@
 * After 20 years of web based attacks on users, security protection is still dependent on the education of users, who are known to be gullible. This is a 2018-12 report from the NSS<ref>NSSlabs, ''NSS Labs Announces Results of 2018 Web Browser Security Test.'' (2018-12-05) https://globenewswire.com/news-release/2018/12/05/1662619/0/en/NSS-Labs-Announces-Results-of-2018-Web-Browser-Security-Test.html</ref>
 <blockquote>Education is a key component of protection against SEM [socially engineered malware] and phishing attacks. Users who are able to identify socially engineered attacks rely less on technology for protection against such attacks. NSS Labs recommends supplementing browser protection with user education to protect against attacks that bypass browser protections.</blockquote>
-* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded insecure content]. On 2019-05-08 the Chrome browser team (then at version 74) announced (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite that having been a requirement in section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which version of Chrome might have this feature.
+* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded insecure content]. On 2019-05-08 the Chrome browser team (then at version 74) announced (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite that having been a requirement in section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which future version of Chrome might have this feature enabled.
 ==Solutions==