DOCSLIB.ORG

Web Application to Progressive Web Application Migration Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Web Application to Progressive Web Application Migration Guide Web Application to Progressive Web Application Migration Guide Cyril Schmitt – Swisscom Digital Technology SA Florian Maffini – Swisscom Digital Technology SA In collaboration with Service de l’informatique et des télécommunications de l’Etat de Fribourg (SITel) March 20th, 2020 WA to PWA Migration Guide | SITel - Swisscom Digital Technology SA 1 / 66 Table of Contents WHO IS THIS DOCUMENT FOR? ................................................................................................................ 4 PROGRESSIVE WEB APPLICATION ............................................................................................................. 5 1 HISTORY ............................................................................................................................................... 5 2 CORE IDENTITY ....................................................................................................................................... 5 3 USER EXPERIENCE ................................................................................................................................... 6 4 MARKET ............................................................................................................................................... 7 DEFINE BUSINESS NEEDS ........................................................................................................................ 10 1 BUSINESS NEEDS ................................................................................................................................... 10 2 USER JOURNEYS AND BUSINESS RULES ........................................................................................................ 10 GATHER WEB CAPABILITIES AND CHECK FEASIBILITY ............................................................................... 12 1 STATE OF THE WEB ............................................................................................................................... 12 2 BROWSER SUPPORT .............................................................................................................................. 16 EVALUATE PWA MIGRATION KNOWING MAJOR DECISION VECTORS ....................................................... 21 1 TECHNOLOGY ...................................................................................................................................... 22 2 FUNCTIONAL COVERAGE ......................................................................................................................... 22 3 DEVELOPMENT COST AND EFFORT ............................................................................................................. 22 4 PERFORMANCE .................................................................................................................................... 23 IMPLEMENT FOUNDATIONAL REQUIREMENTS (LEVEL 1) ......................................................................... 24 1 WEB SITE IS SERVED OVER HTTPS [B1] ................................................................................................... 24 2 PAGES (I.E. URLS) SHOULD LOAD OFFLINE [B2] ......................................................................................... 25 3 WEB APP METADATA FOR HOME SCREEN INSTALLATION [B3] ....................................................................... 26 4 RESPONSIVE WEB DESIGN [E1] ............................................................................................................. 27 5 CROSS BROWSER SUPPORT [E2] ............................................................................................................ 28 6 FIRST LOAD FAST ON 3G [E3] ............................................................................................................... 29 7 SEAMLESS PAGE TRANSITION [E4] .......................................................................................................... 30 8 ONE PAGE = ONE URL [E5] .................................................................................................................. 31 9 USE COMPRESSION FOR TEXT RESOURCES [E6] .......................................................................................... 32 10 ELIMINATE RENDER-BLOCKING RESOURCES [E7] ...................................................................................... 33 IMPLEMENT ADVANCED REQUIREMENTS (LEVEL 2) ................................................................................. 35 1 INSTALL PROMPT BANNER SHOULD BE USED WISELY [O1] ............................................................................. 35 2 INTERCEPT PROMPT AND DIFFER DISPLAY AT A CONVENIENT TIME [O2] ............................................................ 36 3 DETECT AND INFORM USERS ABOUT DISCONNECTION [O3] ........................................................................... 37 WA to PWA Migration Guide | SITel - Swisscom Digital Technology SA 2 / 66 4 AVOID JUMPING CONTENT/IMAGE AS IT LOADS [O4] .................................................................................. 38 5 RETAIN SCROLL POSITION ON PREVIOUS PAGE [O5] ..................................................................................... 39 6 NO OVERLAP BETWEEN KEYBOARD AND TEXT INPUTS [O6] ........................................................................... 40 7 AVOID FRAGMENT IDENTIFIER [O7] ........................................................................................................ 41 8 CONTENT SHOULD BE EASILY SHARABLE [O8] ............................................................................................ 42 9 EXPLAIN USER ABOUT PUSH NOTIFICATIONS CONTEXT [O9] ........................................................................... 43 10 DIM THE SCREEN WHEN REQUESTING PERMISSIONS [O10] ......................................................................... 44 11 NOTIFICATIONS MUST BE TIMELY, PRECISE AND RELEVANT [O11] ................................................................. 45 12 PROVIDE A NOTIFICATION SETTING PAGE [O12] ....................................................................................... 46 13 ALLOW INDEXATION OF PAGES [O13] ................................................................................................... 47 14 METADATA FOR SEARCH ENGINE AND SOCIAL NETWORKS [O14] .................................................................. 48 15 CANONICAL URLS [O15] ................................................................................................................... 49 16 SEAMLESS CROSS DEVICE LOGIN FLOW [O16] .......................................................................................... 50 17 USER CAN PAY USING NATIVE TRUSTED FUNCTIONALITY [O17] .................................................................... 51 IMPLEMENT QUICK WINS (BONUS) ......................................................................................................... 53 1 CLEAN UNUSED CSS [QW1] .................................................................................................................. 53 2 USE OPTIMIZED FORMATS FOR IMAGES [QW2] ........................................................................................... 54 3 MINIFY JAVASCRIPT [QW3] .................................................................................................................. 54 4 TEXT SHOULD REMAIN VISIBLE DURING WEBFONT LOAD [QW4] ...................................................................... 55 5 STATIC ASSETS MUST BE SERVED WITH AN EFFICIENT CACHE POLICY [QW5] ........................................................ 55 6 BACKGROUND AND FOREGROUND COLORS MUST HAVE A SUFFICIENT CONTRAST RATIO [QW6] .............................. 56 7 LINKS SHOULD HAVE A DISCERNIBLE NAME [QW7] ...................................................................................... 56 8 LISTS SHALL ONLY CONTAIN <LI> ELEMENTS [QW8] ..................................................................................... 57 9 USE HTTP/2 FOR ALL RESOURCES [QW9] ................................................................................................. 57 10 USE PASSIVE LISTENERS TO IMPROVE SCROLLING PERFORMANCE [QW10] ....................................................... 58 11 LINKS TO CROSS-ORIGIN DESTINATIONS ARE UNSAFE [QW11] ...................................................................... 58 DEPLOY AND TEST .................................................................................................................................. 59 1 ANALYTICS .......................................................................................................................................... 59 2 A/B TESTING ....................................................................................................................................... 62 FORECAST .............................................................................................................................................. 63 GLOSSARY ............................................................................................................................................. 64 SOURCES ............................................................................................................................................... 65 WA to PWA Migration Guide | SITel - Swisscom Digital Technology SA 3 / 66 Who is this document for? This document is addressed to any software engineering team, developer, project manager or product owner maintaining a Web-based product, publicly available, and willing
Load more

Recommended publications
  • Flutter Basics: the Good and the Bad
    Flutter Basics: The Good and The Bad Flutter has risen quickly as anapp development tool. Originally released by Google in May 2017, Flutter has been used by two million developers since. LinkedIn reports Flutter is the fastest-growing skill among software engineers. This excellent growth is fueled by users’ hopes that it’s an elixir to cure the coding experience of all maladies. Like anything, of course, Flutter has its shortcomings. Let’s take a look. What is Flutter? Flutter is built on the Dart programming language. Developed by Google, Dart was first unveiled in 2011. The language covers the major hot points that a modern language should: it is object-oriented, class-based, and has an added garbage- collector. It has the async, future options out-of-the-box. It has C-style syntax, so should look familiar to JavaScript devs—in fact, devs report they pick up the language quickly. Dart is intentionally simple. Ease comes with costs, so Dart can be executing extra, or less-refined, work in the background. Compared to writing the native code, Dart can be slower and less reliable than a native language. Dart is to JavaScript what Python is to C++. Flutter is an open-source tool for building UIs, particularly on mobile. An essential concept to Flutter is its widgets. Their motto, everything is a widget, is entirely true. All things are widgets. From building layouts with Scaffold and Material App widgets, to BLoC patterns and Provider Widgets, Flutter is built of widgets. Its layouts need to be hand- built, but a few developers created some layout playgrounds to let you build and print the code: mutisya.com flutterstudio.com In this code, you can see how a Text() widget is inside an AppBar() widget is inside a Scaffold() widget.
    [Show full text]
  • Village Lanad To
    Hospi tu 1’s ’ .OIL obstetrics h Village lanad to section to stay open close in October Cass City is “going out of Although village officials ternational Surplus Lines, for extending Ale Street Thanks to a last minute the landfill business” fol- expect eventually to see a will not be renewed by the south through the property. replacement, Ken Jensen, lowing approval by the Vil- savings by closing the land- company. The council indicated it administrator of Hills and lage Council Monday night fill, there will be ongoing The policy, which costs will send a letter of appreci- Dales General Hospital, not to reapply for a license costs (about $3,600 per about $1,200 per year, is set ation to Matt Prieskorn for Cass City, has announced to operate the village’s 40- year) to monitor the site for to expire Aug. 4, LaPonsie his organization of a project the facility’s obstetrical acre Type I11 landfill. the next 5 years. said. in which new lights were unit will remain open. Also approved during the Councilmen approved a recently purchased and in- 65-minute monthly meeting ZONING VIOLATION resolution to seek a quote stalled at the basketball According to Jensen, an was authorization fpr the for the policy from the court. Prieskorn raised announcement about the village attorney to file a suit Turning to the zoning vio- Michigan , Municipal some $800 through clubs unit’s closing had been an- seeking an end to a zoning lation, Trustee Joanne Hop- League. and private donations, ticipated when Dr. Sang ordinance violation by 2 per, who chairs the coun- Also Monday, the council which covered the entire Park, obstetrics and area businessmen.
    [Show full text]
  • Android Stop Pop up Notifications
    Android Stop Pop Up Notifications primates?Incandescent Excruciatingly Tymothy remould macho, incontestably. Artie depleting How gorgets heelless and issullying Christ fondlers.when unnavigated and sexcentenary Peter vernalised some Let us deliver better to stop pop up notifications android ecosystem, turn off notifications In this day and age, and even SMS. All Kaspersky Endpoint Security for Android notifications are enabled by default. Setup on phone, client questions, and applications. Look at the resulting lists quickly, keep in mind that you must set up everything on your browser again, or direct messages. The help desk software for IT. Sometimes more apps notifications are irritating you also. Execute a function as a callback once GDPR consent is granted. How to marital and enable Firefox notifications on Windows Android MacOS iOS Browser settings and main steps to block pop ups. Under settings in touch with the information. Make sure all the GA dimensions are setup and correct VAN. Fret not, click the Gear icon that is the settings for Messenger. If you frequently encounter this situation, I am responding to business, where he specializes in Android OS and Google products. Cannot get workspaces info. What does device protection mean? LINE user with that phone number registered. Segment snippet included twice. Go through the list and enable any apps you want to be able to view and interact with from notifications on screen. Get instant access to breaking news, personalization, or some mode of interaction. These settings apply to all chats by default, you can just block the site sending the notifications, copy and paste this URL into your RSS reader.
    [Show full text]
  • Browsers and Their Use in Smart Devices
    TALLINN UNIVERSITY OF TECHNOLOGY School of Information Technologies Alina Kogai 179247IACB Browsers and their use in smart devices Bachelor’s thesis Supervisor: Vladimir Viies Associate Professor Tallinn 2020 TALLINNA TEHNIKAÜLIKOOL Infotehnoloogia teaduskond Alina Kogai 179247IACB Brauserid ja nende kasutamine nutiseadmetes Bakalaureusetöö Juhendaja: Vladimir Viies Dotsent Tallinn 2020 Author’s declaration of originality I hereby certify that I am the sole author of this thesis. All the used materials, references to the literature and the work of others have been referred to. This thesis has not been presented for examination anywhere else. Author: Alina Kogai 30.11.2020 3 BAKALAUREUSETÖÖ ÜLESANDEPÜSTITUS Kuupäev: 23.09.2020 Üliõpilase ees- ja perekonnanimi: Alina Kogai Üliõpilaskood: 179247IACB Lõputöö teema: Brauserid ja nende kasutamine nutiseadmetes Juhendaja: Vladimir Viies Kaasjuhendaja: Lahendatavad küsimused ning lähtetingimused: Populaarsemate brauserite analüüs. Analüüs arvestada: mälu kasutus, kiirus turvalisus ja privaatsus, brauserite lisad. Valja toodate brauseri valiku kriteeriumid ja soovitused. Lõpetaja allkiri (digitaalselt allkirjastatud) 4 Abstract The aim of this bachelor's thesis is to give recommendations on which web browser is best suited for different user groups on different platforms. The thesis presents a methodology for evaluating browsers which are available on all platforms based on certain criteria. Tests on PC, mobile and tablet were performed for methodology demonstration. To evaluate the importance of the criteria a survey was conducted. The results are used to make recommendations to Internet user groups on the selection of the most suitable browser for different platforms. This thesis is written in English and is 43 pages long, including 5 chapters, 20 figures and 18 tables. 5 Annotatsioon Brauserid ja nende kasutamine nutiseadmetes Selle bakalaureuse töö eesmärk on anda nõuandeid selle kohta, milline veebibrauser erinevatel platvormitel sobib erinevate kasutajagruppide jaoks kõige parem.
    [Show full text]
  • Google AMP and What It Can Do for Mobile Applications in Terms of Rendering Speed and User-Experience
    URI: urn:nbn:se:bth-17952 Google AMP and what it can do for mobile applications in terms of rendering speed and user-experience Niklas Andersson Oscar B¨ack June 3, 2019 Faculty of Computing Blekinge Institute of Technology SE-371 79 Karlskrona Sweden This thesis is submitted to the Faculty of Computing at Blekinge Institute of Technology in partial fulfillment of the requirements for the bachelor degree in Software Engineering. The thesis is equivalent to 10 weeks of full time studies. The authors declare that they are the sole authors of this thesis and that they have not used any sources other than those listed in the bibliography and identi- fied as references. They further declare that they have not submitted this thesis at any other institution to obtain a degree. Contact Information: Authors: Niklas Andersson [email protected] Oscar B¨ack [email protected] External Advisor: Simon Nord, Prisjakt [email protected] University Advisor: Michel Nass [email protected] Faculty of Computing Internet: www.bth.se Blekinge Institute of Technology Phone: +46 455 38 50 00 SE-371 79 Karlskrona, Sweden Fax: +46 455 38 50 57 1 1 Abstract On today’s web, a web page needs to load fast and have a great user experience in order to be successful. The faster the better. A server side rendered web page can have a prominent initial load speed while a client side rendered web page will have a great interactive user experience. When combining the two, some users with a bad internet connection or a slow device could receive a poor user experience.
    [Show full text]
  • By Media Lounge
    BY MEDIA LOUNGE WWW.MEDIALOUNGE.CO.UK PART 01 Search Engine Optimisation As one of the most popular eCommerce platforms in the world, Magento certainly packs a powerful punch in terms of functionality and customisation. Harnessing this power however can be tricky, especially when it comes to getting the most from your site in terms of SEO 01performance. Stores built on Magento can take advantage of some fantastic built-in features that can be individually tuned with just a few clicks, all helping to bring extra visitors and improve the rankings of your site on Google’s SERPs (Search Engine Results Pages). It’s important to remember the value of search engine optimisation when considering any marketing strategy, especially when you’re in the business of selling products solely through an online store - the bigger your audience, the more sales you’re likely to generate. The brilliant thing about SEO is that all the visitors your site receives through this channel are free, which means you don’t need to risk any of that precious advertising budget to see results. We’re going to highlight a handful of these SEO features that you can use to improve your site’s rankings and drive more organic traffic to your store. These simple Magento practices can be implemented by anyone - there’s no requirement for much in the way of technical knowledge, but you will need to dedicate some time to getting things set up correctly. Let’s go! BY CHRIS BY Optimising Meta Titles & Descriptions Hidden within the pages of your website lies the key to success - meta data.
    [Show full text]
  • Searchmetrics Lighthouse Report Your Keywords – Your Market – Your Insights
    Searchmetrics Lighthouse Report Your Keywords – Your Market – Your Insights GET YOUR CUSTOM REPORT www.searchmetrics.com Introduction Work stream overview The project will look at the ranking pages for the most important keywords for your domain in your market. Google search results and relevant URLs will be compared in order to analyze correlations between competitors’ domains based on Google Lighthouse data and reveal ranking factors in the specified market. Work stream details Your most relevant ranking factors will be presented through tables and graphs showing the first 20 positions of Google search results for relevant keyword queries. Results will be related to SEO values, performance and accessibility metrics, as well as best practices in optimization of website performance. www.searchmetrics.com Contents Your custom Lighthouse Report from Searchmetrics includes: • An overview of your domain’s ranking pages’ performance in all Lighthouse categories, based on the keyword set provided • A detailed breakdown of results by ranking position for all Lighthouse categories and the most important audits • A direct comparison for each audit between your domain and your relevant online market (based on the respective keyword set) – revealing where you can improve to match and outpace your competitors • An analysis and actionable recommendations from our experts explain how to optimize to improve your website’s Google Lighthouse results • An executive summary of results and priorities, showing which optimizations are most relevant for your website and where you have the biggest potential for improvement www.searchmetrics.com Overview Of All Categories Performance Progressive Web Accessibility Best Practices SEO Score App Score Score Score Score 75 27 68 70 97 Score Scale: 90–100 50–89 0–49 The scores that you see at the top of any Lighthouse report represent the five category scores.
    [Show full text]
  • Biometriebasierte Authentifizierung Mit Webauthn
    Humboldt-Universität zu Berlin Mathematisch-Naturwissenschaftliche Fakultät Institut für Informatik Biometriebasierte Authentifizierung mit WebAuthn Masterarbeit zur Erlangung des akademischen Grades Master of Science (M. Sc.) eingereicht von: Malte Kruse geboren am: geboren in: Gutachter/innen: Prof. Dr. Jens-Peter Redlich Frank Morgner eingereicht am: verteidigt am: Inhaltsverzeichnis Abbildungsverzeichnis5 Tabellenverzeichnis5 Abkürzungsverzeichnis6 1 Einleitung9 2 Hintergrund 11 2.1 Alternative Lösungsansätze . 12 2.1.1 Multi-Faktor-Authentifizierung . 13 2.1.2 Einmalpasswort . 14 2.1.3 Passwortmanager . 16 2.1.4 Single Sign-On . 17 2.2 Verwandte Arbeiten . 19 2.2.1 Universal 2nd Factor . 21 2.2.2 Universal Authentication Factor . 22 2.2.3 Sicherheitsbetrachtung . 23 2.2.4 Verbreitung . 24 2.2.5 ATKey.card . 27 3 Beitrag der Arbeit 28 4 FIDO2 29 4.1 Web Authentication . 30 4.1.1 Schnittstelle . 31 4.1.2 Authentifikatoren . 34 4.1.3 Vertrauensmodell . 36 4.1.4 Signaturen . 38 4.1.5 Sicherheitsbetrachtungen . 41 4.1.6 Privatsphäre . 43 4.2 Client to Authenticator Protocol . 44 4.2.1 CTAP2 . 45 4.2.2 CTAP1 / U2F . 49 4.2.3 Concise Binary Object Representation . 51 4.2.4 Transportprotokolle . 52 5 Zertifizierung 53 5.1 Zertifizierungsprozess . 54 5.1.1 Funktionale Zertifizierung . 55 5.1.2 Biometrische Zertifizierung . 56 5.1.3 Authentifikatorzertifizierung . 56 5.2 Zertifizierungslevel . 58 3 6 Umsetzung 60 6.1 Smartcards . 60 6.1.1 Betriebssysteme . 61 6.1.2 Kommunikation . 63 6.1.3 Sicherheitsbetrachtung . 64 6.2 Biometrie . 65 6.2.1 Fingerabdruck . 66 6.2.2 Sicherheitsbetrachtung . 67 6.3 Fingerabdruckkarte .
    [Show full text]
  • State Management and Software Architecture Approaches in Cross-Platform Flutter Applications
    State Management and Software Architecture Approaches in Cross-platform Flutter Applications Michał Szczepanik a and Michał Kędziora b Faculty of Computer Science and Management, Wroclaw University of Science and Technology, Wroclaw, Poland Keywords: Mobile, Flutter, Software Architecture, State Management. Abstract: Flutter is an open-source cross-platform development framework. It is used to develop applications for Android, iOS, Windows, Mac, Linux, and web. This technology was released on December 4, 2018, and it is quite young technology with a lack of good architectural patterns and concepts. In this paper authors compared state management approaches used for Flutter applications development and architecture. They also proposed a combination of two approaches that solve the main problem of existing approaches related to global and local state management. The proposed solution can be used for development even complex and big Flutter applications. 1 INTRODUCTION the Java Script code runs in a separate thread and communicates with native modules through a bridge. Nowadays, almost all type of business needs a mobile Flutter, on the other hand, is ahead of time application to existing. The cost of its development compiled to a machine code (arm/x86) and provides depends on complexity and requirements according better performance and even security related to to market coverage. To reduce it usually hybrid or difficulties of reverse engineering (Kedziora, 2019). multiplatform (cross-platform) solutions are used. Not only the UI components are compiled, but the Unfortunately, this kind of solution usually uses whole logic also. Sometimes Flutter apps are even totally different patterns and architectural concepts faster than native Android application, but it depends compared to native Android or iOS applications.
    [Show full text]
  • Programming in HTML5 with Javascript and CSS3 Ebook
    spine = 1.28” Programming in HTML5 with JavaScript and CSS3 and CSS3 JavaScript in HTML5 with Programming Designed to help enterprise administrators develop real-world, About You job-role-specific skills—this Training Guide focuses on deploying This Training Guide will be most useful and managing core infrastructure services in Windows Server 2012. to IT professionals who have at least Programming Build hands-on expertise through a series of lessons, exercises, three years of experience administering and suggested practices—and help maximize your performance previous versions of Windows Server in midsize to large environments. on the job. About the Author This Microsoft Training Guide: Mitch Tulloch is a widely recognized in HTML5 with • Provides in-depth, hands-on training you take at your own pace expert on Windows administration and has been awarded Microsoft® MVP • Focuses on job-role-specific expertise for deploying and status for his contributions supporting managing Windows Server 2012 core services those who deploy and use Microsoft • Creates a foundation of skills which, along with on-the-job platforms, products, and solutions. He experience, can be measured by Microsoft Certification exams is the author of Introducing Windows JavaScript and such as 70-410 Server 2012 and the upcoming Windows Server 2012 Virtualization Inside Out. Sharpen your skills. Increase your expertise. • Plan a migration to Windows Server 2012 About the Practices CSS3 • Deploy servers and domain controllers For most practices, we recommend using a Hyper-V virtualized • Administer Active Directory® and enable advanced features environment. Some practices will • Ensure DHCP availability and implement DNSSEC require physical servers.
    [Show full text]
  • Standard Query Language (SQL) Hamid Zarrabi-Zadeh Web Programming – Fall 2013 2 Outline
    Standard Query Language (SQL) Hamid Zarrabi-Zadeh Web Programming – Fall 2013 2 Outline • Introduction • Local Storage Options Cookies Web Storage • Standard Query Language (SQL) Database Commands Queries • Summary 3 Introduction • Any (web) application needs persistence storage • There are three general storage strategies: server-side storage client-side storage a hybrid strategy 4 Client-Side Storage • Client-side data is stored locally within the user's browser • A web page can only access data stored by itself • For a long time, cookies were the only option to store data locally • HTML5 introduced several new web storage options 5 Server-Side Storage • Server-side data is usually stored within a file or a database system • For large data, database systems are preferable over plain files • Database Management Systems (DBMSs) provide an efficient way to store and retrieve data Cookies 7 Cookies • A cookie is a piece of information stored on a user's browser • Each time the browser requests a page, it also sends the related cookies to the server • The most common use of cookies is to identify a particular user amongst a set of users 8 Cookies Structure • Each cookie has: • a name • a value (a 4000 character string) • expiration date (optional) • path and domain (optional) • if no expiration date is specified, the cookie is considered as a session cookie • Session cookies are deleted when the browser session ends (the browser is closed by the user) 9 Set/Get Cookies • In JavaScript, cookies can be accessed via the document.cookie
    [Show full text]
  • INTEGRIKEY: Integrity Protection of User Input for Remote Configuration of Safety-Critical Devices
    INTEGRIKEY: Integrity Protection of User Input for Remote Configuration of Safety-Critical Devices Aritra Dhar Der-Yeuan Yu Kari Kostiainen ETH Zurich¨ ABB Corporate Research ETH Zurich¨ [email protected] [email protected] [email protected] Srdjan Capkunˇ ETH Zurich¨ [email protected] Abstract Various safety-critical devices, such as industrial control systems, medical devices, and home automation systems, are configured through web interfaces from remote hosts that are standard PCs. The communication link from the host to the safety-critical device is typically easy to protect, but if the host gets compromised, the adversary can manipulate any user-provided configuration settings with severe consequences including safety violations. In this paper, we propose INTEGRIKEY, a novel system for user input integrity protection in compromised host. The user installs a simple plug-and-play device between the input peripheral and the host. This device Figure 1: Example configuration page. Screenshot from the observes user input events and sends a trace of them ControlByWeb x600m [10] I/O server configuration page. to the server that compares the trace to the application payload received from the untrusted host. To prevent programmer device) is easy to protect through standard subtle attacks where the adversary exchanges values means such as a TLS connection [12]. However, if from interchangeable input fields, we propose a labeling the host platform gets compromised—as standard PC scheme where the user annotates input values. We built platforms so often do—the adversary can manipulate any a prototype of INTEGRIKEY, using an embedded USB user-provided configuration settings.
    [Show full text]