Like every large software project, browsers are accidentally broken. But put these unintentional bugs aside for the moment, and imagine an alternate universe in which the browser implements every relevant standard perfectly. Even in this sincerely mythical world, users aren’t safe, because from a security perspective the internet is in many ways broken by design.
Let’s talk about how we’re beginning to mitigate some of these platform-level risks by hardening the defaults, removing barriers to TLS deployment, and giving developers access to new APIs that can be used to lock themselves down even further.
Mike is a philosophy student, cleverly disguised as a member of Chrome’s security team in Munich, Germany. Since it would be more than difficult to make a living sitting under a tree reading Kant, he’s focused his energies on the web, which has proven itself to be a wonderful decision. Mike works on web platform security feature implementation in Chromium and Blink, and specifications in various standards bodies.