4 ms·
You generally wouldn't put adverts on a site that's dealing with security. You should also add subresource integrity as a defence in depth. https://developer.m
by ianpurton 5y ago
You generally wouldn't put adverts on a site that's dealing with security.
You should also add subresource integrity as a defence in depth. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- Asmod4n 5y agoOh, that looks cool.
- goalieca 5y agoThere’s many security sites that load tons of external scripts. My bank is one such example. Even if those third party trackers and such are trustworthy there remains the whole supply chain attack consideration.
- hanniabu 5y agoBanks are never a good example for security. I know mine, which is a big name, still doesn't support OTP 2FA.
- goalieca 5y agoBanks, Enterprise management, ... these are all guarding extremely valuable assets so i considered them security websites (not sure what is more security relevant other than the master email account we all have). They are written in a way that is hard to secure through CSP, disabling javascript, etc.
- technion 5y agoI know you or I or someone on HN talking about secure environments wouldn't put adverts on a site. But I just checked the first thing I could think of (https://www.coinbase.com/signin https://www.coinbase.com/signin) and I can see Google Ads right there. I don't want to sound like I'm calling them out specifically because I'm sure what I'm looking at is entirely normal.
- ianpurton 5y agoYes, I just looked at the source. That leaves them open to an attack, but I guess they trust google. Fingers crossed.
- throwaway888abc 5y agoIt unfortunately apply also to many banks, airlines etc. All the conversion tracking, retention, ads, various third party sdk etc.etc. has full access to user information.