Protecting sites from Cryptojacking with CSP and SRI

Re:Protecting sites from Cryptojacking with CSP and SRI by gambler on Sunday February 11, 2018 @03:15PM (#16354533)

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Access-Control-Allow-Origin...

How many hacks like these will we need before people stop to rethink the fundamental security model underpinning the Web? It's clearly crumbling.

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by JetSpiegel on Sunday February 11, 2018 @05:16PM (#16355139)

We are clearly in the Antivirus level of protection (blacklists) to maintain backwards compatibility, instead of a whitelist of allowed domains or features to use.

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by ubernostrum on Wednesday February 14, 2018 @12:38PM (#16377556)

CSP is a whitelist-based approach; CSS/JS/etc. will only be permitted from the sources listed in the CSP header.

[ Parent | on HN ]