FlowFox
FlowFox: a web browser with flexible and precise information flow control. We present FlowFox, the first fully functional web browser that implements a precise and general information flow control mechanism for web scripts based on the technique of secure multi-execution. We demonstrate how FlowFox subsumes many ad-hoc script containment countermeasures developed over the last years. We also show that FlowFox is compatible with the current web, by investigating its behavior on the Alexa top-500 web sites, many of which make intricate use of JavaScript. The performance and memory cost of FlowFox is substantial (a performance cost of around 20% on macro benchmarks for a simple two level policy), but not prohibitive. Our prototype implementation shows that information flow enforcement based on secure multi-execution can be implemented in full-scale browsers. It can support powerful, yet precise policies refining the same-origin-policy in a way that is compatible with existing websites.
Keywords for this software
References in zbMATH (referenced in 8 articles )
Showing results 1 to 8 of 8.
Sorted by year (- Popescu, Andrei; Lammich, Peter; Hou, Ping: CoCon: a conference management system with formally verified document confidentiality (2021)
- Bauereiß, Thomas; Pesenti Gritti, Armando; Popescu, Andrei; Raimondi, Franco: CoSMed: a confidentiality-verified social media platform (2018)
- Hedin, Daniel; Sjösten, Alexander; Piessens, Frank; Sabelfeld, Andrei: A principled approach to tracking information flow in the presence of libraries (2017)
- Rafnsson, Willard; Jia, Limin; Bauer, Lujo: Timing-sensitive noninterference through composition (2017)
- Bauereiß, Thomas; Pesenti Gritti, Armando; Popescu, Andrei; Raimondi, Franco: CoSMed: a confidentiality-verified social media platform (2016)
- Bello, Luciano; Hedin, Daniel; Sabelfeld, Andrei: Value sensitivity and observable abstract values for information flow control (2015)
- De Groef, Willem; Devriese, Dominique; Vanhoef, Mathy; Piessens, Frank: Information flow control for web scripts (2014) ioport
- Bielova, Nataliia: Survey on JavaScript security policies and their enforcement mechanisms in a web browser (2013)