3 ms·

I visit far more websites in a day than I use strange new apps. Apps also don't suffer from XSS.

by kec 11y ago

Guvante 11y ago
> I visit far more websites in a day than I use strange new apps. From the article you have to "install" the web application for any of these features to be available. > Apps also don't suffer from XSS. From websites sure, but they do from other apps.
- ryao 11y ago
  > From the article you have to "install" the web application for any of these features to be available. As far as the article is concerned, rendering a webpage as if it were an app takes away functionality (mainly, the ability to interact with the address bar). It does not discuss the security of web 2.0 features and it certainly does not claim that these features are only available when the webpage is pretending to be an app. > From websites sure, but they do from other apps. iOS uses capsiculum to isolate applications while Android uses SELinux. They aren't executing each others' code.
  - Guvante 11y ago
    > iOS uses capsiculum to isolate applications while Android uses SELinux. They aren't executing each others' code. XSS isn't about executing other people's code, it is about performing commands that you shouldn't be performing. There are a ton of instances in the pass where cross application communications have lead to privilege escalation in the same way that XSS does.
intrasight 11y ago
Apps suffer from MUCH bigger security issues than XSS. And most modern browsers are immune to XSS.
- ryao 11y ago
  > Apps suffer from MUCH bigger security issues than XSS. It depends on the attack surface. However, something like WebBlueTooth has only one-click/tap authorization protecting it at best against software that is already downloaded and executing. Mis-taps/clicks are trivial. You do not have that with a new application that a website wants you to download. You also tend not to have installed software updated without your consent after you first obtained it (with the trend to use Javascript to add functionality to iOS apps being the glaring exception), but websites can be updated at any time, by both the web developer and by black hats who hack into it.

I visit far more websites in a day than I use strange new apps. Apps also don't suffer from XSS.

by kec 11y ago

I visit far more websites in a day than I use strange new apps. Apps also don't suffer from XSS.

> I visit far more websites in a day than I use strange new apps. From the article you have to "install" the web application for any of these features to be available. > Apps also don't suffer from XSS. From websites sure, but they do from other apps.

ryao 11y ago
> From the article you have to "install" the web application for any of these features to be available. As far as the article is concerned, rendering a webpage as if it were an app takes away functionality (mainly, the ability to interact with the address bar). It does not discuss the security of web 2.0 features and it certainly does not claim that these features are only available when the webpage is pretending to be an app. > From websites sure, but they do from other apps. iOS uses capsiculum to isolate applications while Android uses SELinux. They aren't executing each others' code.
- Guvante 11y ago
  > iOS uses capsiculum to isolate applications while Android uses SELinux. They aren't executing each others' code. XSS isn't about executing other people's code, it is about performing commands that you shouldn't be performing. There are a ton of instances in the pass where cross application communications have lead to privilege escalation in the same way that XSS does.

intrasight 11y ago

Apps suffer from MUCH bigger security issues than XSS. And most modern browsers are immune to XSS.

ryao 11y ago
> Apps suffer from MUCH bigger security issues than XSS. It depends on the attack surface. However, something like WebBlueTooth has only one-click/tap authorization protecting it at best against software that is already downloaded and executing. Mis-taps/clicks are trivial. You do not have that with a new application that a website wants you to download. You also tend not to have installed software updated without your consent after you first obtained it (with the trend to use Javascript to add functionality to iOS apps being the glaring exception), but websites can be updated at any time, by both the web developer and by black hats who hack into it.