sec_login_test - Slashdot User

Comment Re:Why not just include NoScript by default? (Score 5, Informative) 68

by sec_login_test on Friday June 06, 2008 @03:25PM (#23686059) Attached to: Mozilla Experiments With Site Security Policy

NoScript is designed so the user can protect themselves. SSP is designed so that the website owner can protect users from other users, malicious widget developers, or perhaps unscrupulous CDNs.

Submission + - Mozilla Experiments with Site Security Policy

Submitted by Anonymous Coward on Friday June 06, 2008 @12:17PM

An anonymous reader writes: Mozilla has opened comments for an new experimental browser security policy, dubbed Site Security Policy (SSP), designed to protect against XSS, CSRF, and malware-laced IFRAME attacks which infected over 1.5 million pages Web earlier this year. Security experts and developers are excited because SSP extends control over Web 2.0 applications that allow users to upload/include potentially harmful HTML/JavaScript such as on iGoogle, eBay Auction Listings, Roxer Pages, Windows Live, MySpace / Facebook Widgets, and so on. Banner ads from CDNs have had similar problems with JavaScript malware on social networks. The prototype Firefox SSP add-on aims to provide website owners with granular control over what the third-party content they include is allowed to do and where its supposed to originate. No word if Internet Explorer or Opera will support the initiative.

Slashdot Top Deals