News for hackers. Stuff that matters.

A comment on British Airways fined £20m over data breach. Parent comment

Re:British Airways fined £20m over data breach by Nextgrid on Friday October 16, 2020 @09:59AM (#24800861)
> checked their third party JavaScript files regularly

Or used subresource integrity to prevent any unauthorized JS from loading. Or just not loaded third-party JS on the checkout page to begin with.

[ Parent | on HN ]
Re:British Airways fined £20m over data breach by dbm44 on Friday October 16, 2020 @10:13AM (#24800989)
Agreed.

Very poor form for a company of BA's size to have third party JavaScript on the checkout page

[ Parent | on HN ]
Re:British Airways fined £20m over data breach by makomk on Friday October 16, 2020 @10:31AM (#24801126)
As far as anyone's been able to tell, I think the third party JavaScript files were hosted on the same BA server as the website itself, so subresource integrity wouldn't help - the hacker could just change the tags loading the JS so that the integrity checks passed.
[ Parent | on HN ]
Re:British Airways fined £20m over data breach by dkdk8283 on Friday October 16, 2020 @12:44PM (#24802534)
If this is true then they should’ve moved JS to a CDN or something and used SRI.
[ Parent | on HN ]