News for hackers. Stuff that matters.

A comment on Google launches AMP for email. Parent comment

Re:Google launches AMP for email by fixermark on Tuesday March 26, 2019 @04:11PM (#19495568)
AMP gates the JavaScript it allows and requires asynchronous evaluation. 3rd party JS is also allowed, but it has to be in a sandboxed iframe which, in a browser at least, would guard some of the user's state from exfiltration attacks (it's unclear to me if the iframe feature is available in email AMP).

https://www.ampproject.org/learn/about-how/

[ Parent | on HN ]
Re:Google launches AMP for email by fstanis on Tuesday March 26, 2019 @04:31PM (#19495740)
Emails only support a subset of AMP, so iframes and any form of JavaScript (other than the whitelisted AMP components) are not allowed.
[ Parent | on HN ]