3 ms·

>It's amazing to me that an advert can run arbitrary javascript at all. I'm not fully up to date with how these things are usually set up - is there anything i

by dTal 7y ago

>It's amazing to me that an advert can run arbitrary javascript at all. I'm not fully up to date with how these things are usually set up - is there anything in the web security model that prevents "ads" from exfiltrating arbitrary information from any page that they're on? Could an ad read my keystrokes, or scrape private messages?

Aeolun 7y ago
Short answer is yes.
- dTal 7y ago
  Yes, the security model stops them, or yes, they can do those things?
  - gbuk2013 7y ago
    Yes, they can do those things.
ChrisSD 7y ago
It is possible to restrict ads using CORS headers, sandboxed iframes and cross origin restrictions. However this is rarely done effectively. Often the ads have a ridiculous level of access.
londons_explore 7y ago
Ads are iframed, and don't have permissions to do anything to the host page. Doesn't stop them fingerprinting the browser though
- tinus_hn 7y ago
  Typically ads are not in iframes, they are loaded by Javascript from the ad network and can do whatever they want.
  - smilliken 7y ago
    There's multiple nested iframes and scripts loaded at every level. All variations are possible.
    - tinus_hn 7y ago
      Sure, but obviously it’s more valuable if you give the ad access to your DOM so it can ‘optimize the ad placement’.