koto1sa

6 ms·

1.
by koto1sa 7y ago
I don't think you can build applications without using the dangerous sinks at all yet. Some common scenarios we know are common: window.open href Setting text on a script element Setting src of a script element form.action innerHTML Ap
2.
by koto1sa 7y ago
Trusted Types aim to prevent the injection, XSS-y CSP directives (script-src etc) act as an XSS exploit mitigation that fires after the injection is already there. So, for example, even if the JS execution is stopped, the attacker may still
3.
by koto1sa 7y ago
Well, the age of in-browser reflected xss filters is simply over. This was a flawed idea for multiple reasons, and they are thankfully now gone from Chrome and Edge ( https://portswigger.net/daily-swig/xss-protection-dis
4.
by koto1sa 7y ago
Exactly. That said, because the API itself is typed, it is possible to have the runtime enforcement also verified when statically type-checking your application code (e.g. that innerHTML is passed a TrustedHTML value, and not a string) in
5.
by koto1sa 7y ago
Disclaimer: I'm working on the Trusted Types project in Google. To clarify, Trusted Types are not a replacement for XSS auditor. They are both related to XSS, but are fundamentally different and even target different flavors of XSS. Tr
6.
by koto1sa 9y ago
That's a well researched problem, and is common in most JavaScript frameworks. In practice it makes it harder to protect applications using them against XSS. Check https://www.slideshare.net/mobile/x00mario/j
7.
by koto1sa 11y ago
See https://github.com/google/end-to-end/wiki/Key-Distribution . In short, we don't invest much into WoT.
8.
by koto1sa 11y ago
I'm an developer on E2E team as well and can confirm that there's no 'hardening' going on. E2E is, to the best of our knowledge and we have expressed what that exactly means in our threat model: https://github
9.
by koto1sa 11y ago
One of the developers here: Yes, the Keyring reimplementation is in progress and ends very soon. After the redesign, applications built on top of E2E library will be able to use different sources of both public and private keys (so it'
10.
by koto1sa 12y ago
As vague as is may sound, once we feel it's ready. The development is active, but there is still a lot of work to make the project release-ready. You might help too - we started accepting external contributions recently and the project
11.
by koto1sa 12y ago
Symmetric encryption key (Km in the article) get encrypted separately with Alice, Bob, Sam and Joe public keys and then all those encrypted keys get concatenated with the message.
12.
by koto1sa 12y ago
That's this bug: https://code.google.com/p/end-to-end/issues/detail?id=121 , it will get fixed after weekend. Disclaimer: I'm a member of E2E team.