I recently started making a website. I needed to store some credientials info locally in the user's browser. I had to give some thought that I can't let 3rd parties access those credientials and that's lead to a bunch of rabbit holes.
It's surprising the number of services out there that will tell you to embed their JavaScript into your webpage. If you do that then those scripts could be reading all the data on the page including login credientials, your credit card number, contact info, whatever else is on the page.
In other words, for example, to use the disqus comment service you effectively add a script like this
<script src="yourblog.disqus.com/embed.js"></script>
Disqus uses that to insert an iframe and then show all the comments and the UI for adding more. I kind of wanted to add comments to the site above via disqus but there's no easy way to do it securely. The best I can think of is I can make a 2nd domain so that on the main page I create an iframe that links to the 2nd domain and that 2nd domain then includes that disqus script.
I'm not dissing disqus, I'm just more surprised this type of issue is not called out more as the security issue it is.
I looked into how codepen allows embedding a pen recently. Here's the UI for embedding
Notice of the 4 methods they mark HTML as recommended. Well if you dig through the HTML you see it does this
<script async src="https://static.codepen.io/assets/embed/ei.js"></script>
Yes, it powns your page. Fortunately they offer using an iframe but it's surprising to me they recommend the insecure, we own your site, embed our script directly on your page option over the others. In fact I'd argue it's irresponsible for them offer that option at all. I'm not trying to single out codepen, it's common across may companies. Heck, Google Analytics is probably the most common embedded script with Facebook's being second.
I guess what goes through most people's heads who make this stuff is "we're trustworthy so nothing to worry about". Except,
It sets a precedent to trust all such similar sites offering embedded scripts
I might be able to trust "you" but I can I trust all your employees and successors?
We're basically setting up a world of millions of effectively compromised sites and then praying that it doesn't become an issue sometime in the future.
Even if I trust you you could be compelled to use your backdoor.
I suppose this is unlikely but who knows. Maybe the FBI comes knocking requesting that for a specific site you help them steal credientials because they see your script is on the site they want to hack or get info from.
Anyway, I do have comments on this site by disqus using their script and I have google analytics on here too. This site though has no login, there are no credientials or anything else to steal. For the new site though I'll have to decide on whether or not I want to run comments at all and if so setup the second domain.