John Graham-Cumming
Visit any major website, such as a bank or a retailer, and your web browser will run small pieces of JavaScript for web analytics, ad serving, automatic offer targeting or Amazon.com-style recommendations. These so-called tags weren't written by the owner of the website but were provided by a third party. Yet JavaScript's security model, or lack of it, means that any piece of JavaScript in a page can interact with any other piece and with the page itself. So, how does a major bank or retailer know that this code isn't malicious? And where did the code come from? In most cases the website owner has little idea what the codes does, and it typically gets delivered by unsecured email.
This paper and talk look at the risks, both technical and procedural, of the current state of JavaScript page tagging with specific examples from actual websites. It then examines the projects such as CAJA, adSAFE and jsHub that attempt to eliminate this sorry, and potentially disastrous, state of affairs.
