Hacker News Reader

Comment by egberts1 | Hacker News Reader

[flagged]

If it weren't for JavaScript we'd still be downloading binaries and running them unsandboxed on our computers.

As a cybersecurity guy you should know that JavaScript is by far not the entire attack vector in the frontend landscape: the DOM, HTML, HTTP, CSS, browser implementations, etc are a most complete picture. JavaScript itself has evolved and is evolving from its basic roots.

Historically yes because we use unsafe languages just to parse HTML, CSS, HTTP but intrinsically those do not require unsafe things. For JIT the situation is different and without JIT performance would be problematic.

That said, the alternative to web apps is native platforms or other VMs which have the exact same problem except with less capital allocated towards mitigating it.

>For JIT the situation is different and without JIT performance would be problematic.

Not really, at least on desktops: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

Interesting results, but I am talking about the web as an application platform, not as the average users web browsing platform. I find it hard to imagine that users would accept e.g. something like Figma running without JIT, meaning that Figma would have no choice but to move native, thus running into the same problem. That said, for the average web user disabling the JIT by default may be reasonable.

Explain?

Probably something like dom-swapping the google login page or whatever. If you can keep arbitrary CSS transitions running, I could imagine doing a bunch of weird stuff where you don't know exactly what box you're typing in to.

https://developer.mozilla.org/en-US/docs/Web/Security/Attack...

If you can run arbitrary JS on the Google login page then you could simply intercept the form submission and steal the credentials... Am I missing something?

Is the ability to move elements preserving DOM state really the key to such attacks? Previously you could do the same but the iframe would reload - but if it's a small simple page, it could load very quickly, in which case it doesn't seem all that different to moving the iframe with its existing content.

> I could imagine doing a bunch of weird stuff where you don't know exactly what box you're typing in to.

What stops malicious JavaScript that would have used moveBefore() to just add key event listeners?

Reply on news.ycombinator.com