DOM Snitch: Google's passive in-the-browser reconnaissance tool

Re:DOM Snitch: Google's passive in-the-browser reconnaissanc... by paraschopra on Tuesday June 21, 2011 @04:53PM (#2680367)

Gmail stops working if you have DOM Snitch enabled.

I tried it but to be honest did not find it terribly useful. They seem to be using some very simple rules for best practices (like avoiding document.write). But it's nothing more than that (yet)

[ Parent | on HN ]

Re:DOM Snitch: Google's passive in-the-browser reconnaissanc... by miguel_lourenco on Tuesday June 21, 2011 @07:01PM (#2680772)

Sites might break when you have DOM Snitch enabled. You can always right click and put it in "Standby" mode, which should solve the problem. There are at least two known issues that can cause this, listed at https://code.google.com/p/domsnitch/wiki/KnownIssues. I don't know what might be causing it to break GMail, could be a lab or that it simply was never tested much with GMail.

I wouldn't really call them rules. The tool looks for use of dangerous JavaScript APIs and, when it detects them, it gives you more information, such as stack trace and arguments. That information should help someone determine if a particular use is insecure. Besides that it has some relatively simple logic to determine if a particular usage might be a security bug or not, which is indicated through different colors.

[ Parent | on HN ]

Re:DOM Snitch: Google's passive in-the-browser reconnaissanc... by miguel_lourenco on Tuesday June 21, 2011 @07:05PM (#2680779)

FWIW, Gmail does not seem to break for me when I use it there.

[ Parent | on HN ]