Since the dawn of the graphically based internet, the languages and standards that your web browser uses to deliver content to you have evolved substantially. With each new evolution in web standards, a whole new range of options appear for web programmers and hackers alike. In the recent past, the fragmentation of different web browsers in use as well as differing methods of displaying content (Flash, Java, AJAX, Etc.) has limited many web exploits to specific segments of the internet populace. With the recent adoption of HTML5 by the World Wide Web Consortium (W3C), some of these factors may be poised to change.
As the new standard of HTML5 continues to be integrated into more web browsers and sites, the potential for new exploits may be increasing. Among its’ many new features, HTML5 allows developers the ability to embed video and other media without the use of Flash, and has expanded the ability for a website to store information on your PC. These changes are designed to not only enhance the overall user experience, but potentially may break the grip that some proprietary software such as Adobe’s Flash have upon the internet at-large. These are laudable goals, to be sure, but with new standards often come potential for new risks. For example, web programmers have always had the ability to store data on your computer. Mostly this has been in the form of the much maligned and often misunderstood cookie file, as well as direct file caching on your PC to enhance load times of often visited pages. In HTML5, however, taking advantage of the new advances has caused web applications to turn to creating entire databases on your PC to support their increasingly complex feature sets. If these types of data caching activities are not executed properly, internet users could soon be storing more of their personal data, including passwords and account information on their PC without ever knowing it’s there. It is precisely because all manner of data can now be stored on a PC without the user’s consent or knowledge that such vulnerable storage could be such an attractive and relatively easy target.
As of right now, almost all modern web browsers have adopted most of, if not all of these new specifications. In addition, the standard option in these browsers to clear offline data won’t necessarily remove all traces of this new type of storage. As a result, the end-user is largely at the mercy of each site’s developer to assure that none of their data is handled in an insecure fashion. Since HTML5 is still in it’s’ infancy, there are as of yet no standards for protecting your personal data from possible exploitation, and it falls to each of us to carefully consider our actions online. For the foreseeable future, we’re all in a whole new, possibly very insecure, world wide web.

