Your Website Is Running Code You’ve Never Seen
summary
Websites load huge unseen third-party JavaScript — 98.1% of pages and a median of 680 KB of JS — which can be modified via S3 or Google Tag Manager compromises, leading to incidents like a £189M British Airways fine, a £1.5M Ticketmaster penalty, and a $1.46B Bybit crypto theft that changed payment addresses. Practical defenses shown include CSP report-only with report-sha256 for client-side visibility, SRI for static assets, Integrity Policy to enforce SRI, plus COOP/COEP and Clear-Site-Data.
AI-written summary · about
chapters (7)
- 0:00Third-party JS risks
- 8:09Scale of third-party JS
- 17:13Exposure to third-party code
- 23:30Content Security Policy
- 32:10Subresource Integrity
- 41:42Security measures and standards
- 50:49Q&A
related talks
48mRegulation and Risk When Your Customer’s Browser Leaks Data
22mVampires in the Browser: banishing uninvited Javascript from your web app
40mHostile JavaScript: Attacking and Defending the Browser
46mDeep dive into third-party performance
33mHacking your Front-End Apps
29mYour Scripts In My Page - What Could Possibly Go Wrong?
19mWeb Platform Security
59mThe Final Frontier: Security APIs in Modern Browsers