Protecting sites from Cryptojacking with CSP and SRI

Re:Protecting sites from Cryptojacking with CSP and SRI by quickthrower2 on Sunday February 11, 2018 @05:48PM (#16355293)

Something like JS 'permissions' could help here. I.e. load a script but limit how much CPU/GPU access it has plus determining if it has DOM access, XHR access, etc. So you load the script and tell it what it can do. Also developers taking security more seriously. But it is rarely a priority, since risk reduction is not paid for today.

[ Parent | on HN ]

Re:Protecting sites from Cryptojacking with CSP and SRI by shrumm on Sunday February 11, 2018 @06:28PM (#16355434)

I like this option, similar to how apps request permissions on a mobile OS. There could be a default list of modifications an external javascript script can run, any further access must be explicitly white listed by the developer. Then even if the script was malicious, at least the impact is controlled.

for instance, maybe the default is that an external script can read the DOM but needs extra permissions to write/modify it?

[ Parent | on HN ]