What Can Traditional Web App Security Learn From Browser Wallet Extensions?
summary
Claims that hardening the client prevents irreversible crypto theft by confining untrusted code via compartments and per-dependency static analysis. Implements a JavaScript shim called lava mode that generates whitelist policies, loads each npm dependency in its own compartment, and throws on unauthorized APIs like fetch at runtime. Integrates into build/CI so policy diffs block merges and require policy diff review. Project runs in production (MetaMask, Agoric), is effective against many supply‑chain attacks, but remains experimental with onboarding and granularity tradeoffs.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:28Traditional web app security
- 7:09Decentralized security challenges
- 12:05Why client-side security matters
- 17:03Mitigating supply chain attacks
- 28:48Centralized vs decentralized security
- 33:28Q&A: Policy generation
- 36:20Q&A: Scalability
- 41:43Q&A: Policy granularity
- 43:28Q&A: SES adoption
- 45:14Summary
related talks
29mGal Weizman @ ReactNext 24`
53mArchitecting Robust JavaScript Applications
24mBitcoin Web Application Security
32mSecurity-First Web Apps
58mPractical Secure Development and Operations with JavaScript in 2020
30mAchieving the Web Isolation Nirvana - How far along are we?
15m“Security” in the JavaScript ecosystem
26mBeyond the Basics: Securing JS Applications