Achieving the Web Isolation Nirvana - How far along are we?
summary
Shows a runnable client-side sandbox that is embeddable and requires no browser modification, demonstrates a plain compromised third‑party script exfiltrating credentials, then compares isolation approaches: iframe blocks DOM access but forces re‑engineering, a Caja/Kaha‑style transformation that whitelists APIs prevents exfil but needs upfront API lists, and a JScrambler‑style agent gives visibility and blocks exfiltration in real time. Claim: parts work today, full holistic coverage remains incomplete.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:48History of Web Isolation
- 6:38Web Isolation Approaches
- 13:34Principles of Web Isolation
- 17:13Demos
- 22:02CAHA
- 23:44Sandbox
related talks
55mWeb Application Security: Browsers Fight Back!
59mThe Final Frontier: Security APIs in Modern Browsers
35mJavaScript Realms: The Blank Spot In Web App Runtime Security
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
36mHTML5 JS Security
47mDOM Jungle - Can We Trust The UI?
40mHostile JavaScript: Attacking and Defending the Browser
18mWriting an (in)secure webapp