Since there was some attention to a CSS driven keylogger, it’s good again to point out the security risks of third party content. That risk is huge.
When a third party CSS Stylesheet can steal your password, it would be a piece of cake for any Javascript script to do the same.
If you follow this blog, it will not surprise you that we’re skeptical to all the JavaScript driven frameworks that are fashionable. In general Javascript is bad for security, privacy, and the planet 🙂 : battery usage. It’s good for tracking, fingerprinting and advertisements, and visual eye-candy.
Yes, JavaScript can be nice, but please adhere to these old principles: graceful degradation and progressive enhancement. And it’s fashionable not to follow those principles.
Don’t force JavaScript, because you’re trying to sell adds, or track users.
Don’t overdo JavaScript: an URL with your contact info should have your contact info (in HTML). Otherwise you should point to another URL. Don’t hide this information behind Javascript and in JSON somewhere. You’re breaking the internet. Keep information accessible.
It’s important to underline again. Every script that is loaded with <script> has access to the DOM, and if the page is a login page, it has access to the password and username.
So a simple principle can be deducted, and it’s a shame that we have to repeat it here.
Never add any (third party) script to a login page. NEVER.
Nobody should be authorized to have access to a plain password, except for the user. Nobody. Limit access by design, not by trust.
Even if you, as company or developer, do trust the third party, what about the client? And even if the third party is trusted, it’s still wrong. You should limit the amount of eyes that CAN peek on a secure content. It’s not about trust, it’s a simple principle of security.
So any company that uses third party scripts on a login page, is doing it wrong. Third parties should not have access to passwords by design!
I guess, 80% percent of all companies/websites are making this mistake. Maybe 90%. Shocking.
Tags: security