Microsoft looks to secure Web content

Microsoft will herald a security project called Web Sandbox, for securing Web content through isolation, at the company's Professional Developers Conference in Los Angeles this week.

The Microsoft Live Labs Web Sandbox features a prototype of technology for mashing up code while maintaining better process isolation, quality of service protection, and security, according to the company.

"This will foster more efficient cross-browser development, increased mash-up innovation, and new third-party extensibility models," according to a description of the PDC effort released by a Microsoft representative.

The Live Web Sandbox Web site describes the project as addressing the problem of modern Web applications being "intrinsically insecure, often with unpredictable service quality."

"Today, Web gadgets, mashup components, advertisements and other third-party content on Web sites either run with full trust alongside your content or are isolated inside of IFrames," resulting in a lack of security, the Web page states.

"We have created a cross-browser JavaScript virtualization layer that provides a secure standards-based programming model without requiring any add-ons," according to the site. "We are not done yet. We need your help: Experiment with the Sandbox and make sure it works. We've included a set of samples so you can try to break the Sandbox. Our goal is to provide reusable components that will allow you to secure your Web 2.0 mashups. Our goal is to work together to standardize a secure Web platform. "

A growing number of Web 2.0 applications incorporate third-party content either via direct script inclusion or embedded in an IFrame, Live Labs said. Components included directly execute with full trust and can access private information, according to Live Labs. This leaves a site subject to intentional or non-intentional bugs that could compromise personal information or degrade a Web application's quality of service.

IFrames, meanwhile, offer isolation but not complete security, Live Labs said. Malicious code can try to install ActiveX controls, redirect users, or interrogate a browser history, thus degrading quality of service. IFrames also pose a problem with providing an integrated experience and sharing data across components, the labs said.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email Computerworld
• Follow Computerworld on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark