Regulation and Risk When Your Customer’s Browser Leaks Data
summary
Claim: the browser-centric web breaks the old security model because any loaded JavaScript can read or exfiltrate page data. Measured findings: modern e‑commerce pages average 100 scripts per site, about half third‑party, contacting an average of 13 domains (up to 35). Real incidents: hospitals leaking protected health data to Meta and Google (Google on 98.5% of sites), British Airways and Ticketmaster card skims, and a 174% rise in card skimming. Defenses tested: CSP and SRI (fragile), PCI DSS v4 requirements, and mitigation tools like Cloudflare Zaraz, Jscrambler WPI and Partytown.
AI-written summary · about
chapters (7)
- 0:00Introduction and web security model
- 1:58Technical introduction to JavaScript risks
- 9:04Four threat actors leaking browser data
- 21:40Regulatory responses to JavaScript risks
- 31:58Technical and regulatory solutions
- 43:04Actionable steps for organizations
- 46:45Summary and predictions
related talks
57mYour Website Is Running Code You’ve Never Seen
30mTargeted Web Skimming on E-Commerce Sites
29mYour Scripts In My Page - What Could Possibly Go Wrong?
30mGDPR and Third Party JS - Can It Be Done?
40mHostile JavaScript: Attacking and Defending the Browser
19mWeb Platform Security
55mWeb Application Security: Browsers Fight Back!
49mBeyond Cookies: The Unseen Privacy Risks of Web Analytics