GDPR and Third Party JS - Can It Be Done?
summary
Demonstrates that adding one remote script can read forms, hijack clicks and exfiltrate credentials (demo against a bank site), notes a real keylogger-in-a-bank add‑on and a Pizza Hut compromise, and cites 85% of exploits coming via third parties and a median detection three months. Explains GDPR duties (articles 16/17/18) that make sites responsible for third parties, surveys mitigations — iframe sandboxes, HTTP headers, and policy libraries like AdSafe and Caja — and argues for low‑overhead, transparent isolation.
AI-written summary · about
chapters (10)
- 0:00The risks of third-party scripts
- 2:04Demonstrating browser vulnerability
- 3:33Third-party script mechanics
- 6:40Security impacts and GDPR
- 9:36GDPR articles and responsibility
- 12:00The challenge of enforcement
- 13:25Technical security tools
- 17:17Organizational and cultural friction
- 20:24Proposed solutions and conclusion
- 23:05Q&A session
related talks
29mYour Scripts In My Page - What Could Possibly Go Wrong?
40mHostile JavaScript: Attacking and Defending the Browser
48mRegulation and Risk When Your Customer’s Browser Leaks Data
55mThird-Party Code: Where Data Breaches, Election Meddling, Ad Fraud Converge
57mYour Website Is Running Code You’ve Never Seen
33mHacking The Front-End
22mVampires in the Browser: banishing uninvited Javascript from your web app
40mHow I Hacked Your Website and You Didn’t Even Know