From Context, ‘an independent information security consultancy’:
This gives a medium level description of the technology.
It distinguishes between user mode and ‘kernel mode’.
It fails to describe what I presume to be a card vendor supplied compiler to transform web-site supplied ‘programs’ binary programs of a vendor proprietary format.
It mentions the ‘same-origin policy’ and that it of a perhaps obsolete style of security.
It gives enough detail to become aware of several sorts of potential vulnerability, depending on the reader’s background.
Writing about these issues is difficult.
Quote:
For example it is perfectly acceptable to embed an image from outside of your domain because the underlying APIs never gave you a mechanism to read the actual content (outside of image dimensions, and an indication of success or failure to load).
It is not clear who the word ‘your’ above refers to.
I presume it is the author of the first web site.
It would be well to list the stake holders and give them names.
The particular protection under discussion here is when one site presents a page P to the browser and P directs the browser to include content, S, from another site in a sub-area of the screen space allocated to P.
To propose that S should be concealed from the author of P implies that there is information that would be inaccessible to the author of P by merely fetching the URL by which P denotes S.
This may arise when the browser’s network connection conveys more authority than any connection available to P’s author which may arise when the browser is behind a firewall.
It may also arise when cookies from the user’s machine are presented to the site for S.
These are confusing issues and WebGL confounds them but it is not clear to me whether it not the earlier web protection notions that are to blame.
The security issues of such image subsetting cannot be divorced from the issue of how the user knows which pixels are from which site, and what query by P provoked S to say what it said.
Is there any useful security here for WebGL to preserve?