Output details
11 - Computer Science and Informatics
Imperial College London
Output title
Object Capabilities and Isolation of Untrusted Web Applications
Type
E - Conference contribution
Name of conference/published proceedings
Symposium on Security and Privacy
Volume number
-
Issue number
-
First page of article
125
ISSN of proceedings
1081-6011
Year of publication
2010
URL
-
Number of additional authors
2
Additional information
<19>Acceptance: 11%/237.
This paper proposes a technique for building secure web pages using components loaded from domains enjoying different levels of trust (web mashups).
The idea is to constrain components to access resources using unforgeable permissions (capabilities) distributed by the page owner. Components with disjoint capabilities cannot interfere with each other.
We validated our approach by showing that the Google subset of JavaScript is safe and by discovering violations of the isolation policy for Facebook applications.
Coauthor Taly obtained Google internship and now works in Google Security group, which Maffeis visited May'13.
Interdisciplinary
-
Cross-referral requested
-
Research group
E - Programming Languages and Systems
Citation count
9
Proposed double-weighted
No
Double-weighted statement
-
Reserve for a double-weighted output
No
Non-English
No
English abstract
-
