Node+JS Interactive

Passwords have been used as the main method of authentication since the WWW was born. Their biggest flaw is that their effectiveness depends on their entropy, and humans are a bad source of entropy. Progress has been made at this time as multiple factors for authentication are now more and more common. This talk is about the Web Authentication API that is being worked on, how it fits in the current ecosystem of web apps and why it's important for users.

Over the last year, the Node.js security working group has been working to build trust and make the ecosystem safer through a number of initiatives. During this panel discussion, members of the working group, security researchers, and companies deploying Node.js will discuss some of the key challenges and progress to make the Node.js platform and ecosystem safer. We’ll cover it all including security reporting, internal triaging processes, CVE assignment, and current and future initiatives to strengthen security measures in the ecosystem.

Who might want to attack your application? If they tried, how would they succeed? Answering these questions is an important exercise that helps you understand how to keep your application secure, so you can sleep at night.

In this talk, Adam will teach you what threat modeling is and how to build threat models for your organization and applications. Because npm is such a critical part of how your developers build JavaScript applications, Adam will show you how npm fits into your threat model and how to use npm's tools to keep your JavaScript secure.

Applicative Denial of Service is mostly known through Regexp abuse. Most people do not know that other applicative DoS can be exploited through diverse means. In this talk, we will see how a malicious user can obtain a MongoDB injection and use it to prevent an application from responding.

Intro: Applicative DoS
I. From SQL injections to NoSQL injections
II. Exploiting a NoSQL injection to obtain a DoS
III. Protecting an application from MongoDB applicative DoS

When speaking about security in the Node.js world, most efforts have been in direction of the choice of packages. However, most security issues are not coming from third-party modules but from misuse of them.

This talk aims at showing how fragile an application can be and how one should protect it.