4 ms·
3 things I don't understand about your product (but I like the idea in general of helping people get over the initial cliff of enabling CSP): 1. How does inclu
by buro9 7y ago
3 things I don't understand about your product (but I like the idea in general of helping people get over the initial cliff of enabling CSP):
1. How does including a bit of JavaScript apply a CSP and block things if the CSP is not sent via HTTP headers? Are you installing a service worker and proxying every request through that so that you can apply the blocking or something? (I have not looked into this area for a while)
2. How is adding another 3rd party resource not expanding the attack surface rather than reducing it?
3. How do you know what is good/bad and should be allowed/denied?
On #3 I run a few hundred forums that have user generated content and whitelist a small number of 3rd party embeds such as YouTube, Google Maps, Strava, etc. I want those to keep working but don't wish anything not in my whitelist to work. But if I expanded the list in future to allowed embedding Twitch... how would your system know that this is a "good" action and to allow it?
- jrpt 7y agoYou're correct that it's not using CSP headers (which is difficult in practice to use), which is why I call it a virtual content security policy. Yes, it's another resource that expands your attack surface but when you have sites running tens of scripts already, I think one more is a small attack surface delta, and there's ways to minimize that risk too. For knowing what to allow/deny yes there's blacklists but also various more intelligent things as well. That's one of the problems with CSP headers is that they're too black and white today. With Enchanted Security, for example, you can configure it to say things like "allow Google Analytics but only for my tracking id UA-123456789-1" (this is because hackers have used Google Analytics as a data exfiltration mechanism where they sent data back to their hacker-controlled GA account)