Om Malik wonders if people are seeing Gmail outages. Yes is the answer.

The reason is that Google is feverishly working to patch Cross-site scripting(XSS) security problems - as reported by Philipp and Jeremiah Grossman.

People have no idea how insecure browser based apps currently are. Read this XSS / CSRF FAQ to start. I predict 2007 will see a massive increase in XSS security problems and awareness.

Simple rule in the meantime: Don't store anything really important on the internet. Seriously.

Update: I feel a little silly about that last piece of advice, since the internet is so intrinsic to business these days.

The CSRF threat is that someone could get a hold of Javascript data while your browser is logged into an app like Google GMail, or AdWords.

It struck me that Google AdWords, MSN AdCenter and Yahoo's Panama probably have a ton of interesting stuff sitting in Javascript data structures. That data was / is probably vulnerable as well. It's probably just a matter of time until someone exploits one of those.

Labels: predictions security XSS gmail

¶ 1/18/2007