Protecting sites from Cryptojacking with CSP and SRI

Re:Protecting sites from Cryptojacking with CSP and SRI by Feniks on Sunday February 11, 2018 @01:38PM (#16354006)

"On top of all of that, you could be alerted to events like this happening on your site via CSP Reporting"

Too bad this can be abused by marketing parasites.

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by orf on Sunday February 11, 2018 @02:36PM (#16354310)

How?

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by dullgiulio on Sunday February 11, 2018 @04:13PM (#16354829)

CSP reporting is an unprotected form, in itself a vulnerability.

The author of the article is biased as he made a SaaS product for CSP reporting.

CSP reporting should be for local debugging only.

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by orf on Sunday February 11, 2018 @04:56PM (#16355051)

I'm sorry, I'm still not following. How can CSP reporting be used by marketers? It requires a header sent from the server, so it's not like a tracking pixel that can be added by a third party. And I'm not sure about local debugging only, locally it offers no benefits over just viewing the devtools console, whereas it offers a lot of benefits when enabled on users of your sites.

[ Parent | on HN ]