Thursday, January 28, 2010

Academic paper on Chromium extensions

Protecting Browsers from Extension Vulnerabilities is a paper that covers some of the interesting security features of the Chromium extension system.

The isolated worlds feature that I wrote about earlier is described toward the end. Isolated worlds separate each JavaScript program that has access to a web page's DOM. Each program can modify the DOM and see changes made by other programs, but programs cannot exchange JavaScript references. This setup prevents privileges from accidentally leaking between programs. Isolated worlds are now implemented directly in WebKit (thanks to Adam Barth), so they could show up in other WebKit applications in the future.

My other favorite feature is that an extension's unique ID is a public key. The extension is signed with the corresponding private key, which means it is impossible to have ID collisions. Even if a developer copies an existing extension to get started, he won't be able to copy the extension's ID because he would need the private key in order to sign it.

2 comments:

Anonymous said...

China and Russia put the blame on some screwed up experiments of US for the earthquake that happened in Haiti.
Chinese and Russian Military scientists, these reports say, are concurring with Canadian researcher, and former Asia-Pacific Bureau Chief of Forbes Magazine, Benjamin Fulford, who in a very disturbing video released from his Japanese offices to the American public, details how the United States attacked China by the firing of a 90 Million Volt Shockwave from the Americans High Frequency Active Auroral Research Program (HAARP) facilities in Alaska
If we can recollect a previous news when US blamed Russia for the earthquake in Georgio. What do you guys think? Is it really possible to create an earthquake by humans?
I came across this [url=http://universalages.com/hot-news/what-happened-in-haiti-is-it-related-to-haarp/]article about Haiti Earthquake[/url] in some blog it seems very interesting, but conspiracy theories have always been there.

Anonymous said...

like gambling? love las vegas? make an effort the all far-out [url=http://www.casinolasvegass.com]casino[/url] las vegas at www.casinolasvegass.com with on the other side of 75 changed unproven [url=http://www.casinolasvegass.com]online casino[/url] games like slots, roulette, baccarat, craps and more and positive a control in honourable coins with our $400 in a dither bonus.
we from up to from time to time in a coarse moon sensible games then the pass‚ online [url=http://www.place-a-bet.net/]casino[/url] www.place-a-bet.net!