[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <16081501-6C23-4F5A-84DE-D3DCAE7982F7@gmail.com>
Date: Mon, 31 Oct 2022 07:19:05 -0500
From: Brandon Perry <bperry.volatile@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Is third party javascript on a login page
considered dangerous?
It depends.
You can prevent some classes of JS running such as inline JS so only trusted JS is executed. If you design your site to expect to pull from a specific CDN all the time, disabling inline JS (third party or otherwise) would prevent any attacker-controlled JS (say from XSS) from executing on the login page while letting you use any “safe” or trusted js.
If you perform SHA sum checking on resources with resource integrity from third party sites, you can be sure you won’t load a backdoor or otherwise-modified version after deployment.
If you are loading third party JS from a trusted source, but not performing resource integrity checks over plaintext HTTP, you obviously still can’t trust the final JS delivered.
Using third-party JS on a login page isn’t inherently dangerous. Having no control or ability to know when that JS changes is the dangerous part.
> On Oct 31, 2022, at 4:16 AM, Georgi Guninski <gguninski@...il.com> wrote:
>
> In short, is third party javascript on a login page considered dangerous?
>
> The JS has full access to the DOM of the page and can steal
> the username and password, which might be reused on other services,
> making it yet another cross site cookie, lol.
>
> In general, the JS persists after login, potentially giving
> access to sensitive information.
>
> I believe static analysis can't catch all JS, since one script
> may load another script.
>
> Also, the JS might be dynamic, depending on the user.
>
> Experience suggests the main 3rd party JS comes from google
> and google do [k]no[w] evil [1]
>
> Examples:
> bugzilla.mozilla.org loads from googleanalytics
> *.stackexchange.com loads from google and cloudfare.
>
> [1] https://en.wikipedia.org/w/index.php?title=Don%27t_be_evil&oldid=1109436328
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
