Secure interfaces for a person-to-person service exploitation Infrastructure - Lopes, André Ribeiro (2018)
With the dawn of interactive Web Applications the face of the Web was changed forever. Web sites are no longer the lifeless, static pages of the past, thanks to Javascript they became full-ﬂedged interactive applications, now competing with their desktop counterparts. Thus, for a privacy-oriented architecture proposed for service sharing, it was decided to design them as Web applications, naturally using Javascript. However, this language presents some serious security issues, and since the architecture should tolerate the inclusion of untrusted third-party Web applications, allowing an unconstrained use of Javascript in those applications is unacceptable. Since removing all Javascript is not an option when it comes to build interactive, modern, Web applications, we need somehow to use controlled Javascript. Many solutions were developed in the past that try to isolate trusted Javascript and sensitive information on a Web page with unstrusted Javascript. Our approach is diﬀerent because we do not analyse existing Javascript code deployed within Web Applications, as others did. Instead, we completely ﬁlter out any Javascript used by our applications, and we use special annotations in Web pages to inject our own, risk-free Javascript code. Thus, we designed and developed a system able to parse certain keywords (or annotations) that translate into safe Javascript code, which allows us to have a complete control over the Javascript code running on an application plugged into this architecture. For asserting a minimum set of annotations necessary to build an appealing and reactive Web application, we developed three diﬀerent applications that use them: a photo sharing gallery, a text chat and a voice chat.