News for hackers. Stuff that matters.

A comment on Google launches AMP for email. Parent comment

Re:Google launches AMP for email by fixermark on Tuesday March 26, 2019 @01:54PM (#19494345)
It looks like they're leveraging the safety aspect of AMP here. IIUC, the subset of HTML behavior AMP enables is generally considered to be "safe." If that property can hold, AMP-enabled email can allow for the benefits of live HTML in the client without the drawbacks of the surprises that can occur from arbitrary HTML execution.
[ Parent | on HN ]
Re:Google launches AMP for email by lucasyvas on Tuesday March 26, 2019 @11:18PM (#19497919)
Google uses increased security as an excuse and tactic to trick you into using something that you would otherwise have zero interest in.

They wave the banana to distract, but the gorilla comes with it.

[ Parent | on HN ]
Re:Google launches AMP for email by fauigerzigerk on Tuesday March 26, 2019 @02:57PM (#19494927)
Does AMP not allow JavaScript?
[ Parent | on HN ]
Re:Google launches AMP for email by fixermark on Tuesday March 26, 2019 @04:11PM (#19495568)
AMP gates the JavaScript it allows and requires asynchronous evaluation. 3rd party JS is also allowed, but it has to be in a sandboxed iframe which, in a browser at least, would guard some of the user's state from exfiltration attacks (it's unclear to me if the iframe feature is available in email AMP).

https://www.ampproject.org/learn/about-how/

[ Parent | on HN ]
Re:Google launches AMP for email by fstanis on Tuesday March 26, 2019 @04:31PM (#19495740)
Emails only support a subset of AMP, so iframes and any form of JavaScript (other than the whitelisted AMP components) are not allowed.
[ Parent | on HN ]