[dom0]

I've recently done some research in this direction and was kind of startled that there appears to be practically no interest in how to secure (for example "cryptomessenger"ish) SPAs. There are some things that can be done to compartementalize things a bit (eg. web workers), in the hope that it might mitigate next days' browser bugs, but at the end of the day everyone seems to put a huge amount of trust into a runtime environment of startling and ever increasing complexity and thus a security track record that's mediocre across all vendors at best.

Further adding to it are untethered, unchecked extensions in eg. Firefox. Every extension in Firefox is essentially running with full "browser root" privileges. Chrome at least has a privilege system that tries to avoid allowing every extension to attach a debugger to anything.

(I was also surprised that "how do i run that untrusted JS in my JS context 'safely'?" is a question asked and answered many times)

[bugmen0t]

Two notes:

2) There is interest and progress on securing web applications: - For early research papers look into 'Privilege Separation in HTML5 Applications' by Devdatta Akhawe et al. <https://www.usenix.org/system/files/conference/usenixsecurit.... - For more practical concerns, see the stuff coming out of the W3C WebAppSec Working Group (CSP, Suborigins, etc.). - For Sandboxing/Compartmentalization of code, see the Realms proposal coming in to a future version of ECMAScript (JavaScript): <https://github.com/caridy/proposal-realms>

2) Firefox new-style extensions (WebExtensions) are in fact least-privilege.