Code-Origin Policy: Towards a Formal User Privacy Protection for the Web
summary
Claims a code-origin policy that mediates JavaScript at runtime by tracking the code’s source, enforces per-origin permissions (cookies, network, DOM) and lets users edit policies, not just block everything. Shows a working browser extension prototype that inspects the call stack and applies origin-based rules, describes dynamic limits (rate and history based) and outlines generating a certificate verified at runtime to prove policies were produced at build time and actually enforced.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:43History of the Web
- 1:38Formation of the Web
- 5:27Browser Security
- 7:42Limitations
- 11:25What we worry about
- 13:46Current approaches
- 16:16Approach
- 19:08CodeOrigin Policy
- 19:50Prototype Implementation
- 20:26Policy Enforcement
- 21:39Formal Insurance
- 23:50Related work
- 24:49Long term vision
- 25:26Challenges
related talks
29mSame-Origin Policy: Evaluation in Modern Browsers
16mFrom security as opt-in to security by default
28mBypassing Same-Origin Policy
08mEnable and debug cross-origin isolated
59mThe Final Frontier: Security APIs in Modern Browsers
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
13mPreparing for a more private web
16mOpen web standards with Privacy Sandbox