Comments on: Durable Objects

By: Javascript silo proposals « captain holly java blog

Javascript silo proposals « captain holly java blog — Fri, 26 Mar 2010 03:18:14 +0000

[...] This article carries this idea further to create “Durable” objects — objects that, even though they have publicly accessible methods cannot have them switched out by another script. [...]

By: Douglas Crockford

Douglas Crockford — Mon, 02 Jun 2008 19:22:35 +0000

Billy,

Suppose you have a method C that calls this.A and this.B. If an attacker replaces your methods with his, then C will be compromised. Function C would be vulnerable if it used this.

Rytis,

Inheritance is obtained by calling another durable constructor.

var that = another_constructor();

By: James Norton

James Norton — Thu, 29 May 2008 11:21:34 +0000

I agree with Billy, what is the difference between what you propose and instantiating an instance of a constructor with private members?

By: Rytis Daugirdas

Rytis Daugirdas — Wed, 28 May 2008 16:12:28 +0000

But what about inheritance? How would you inherit properties/methods from another “durable” object?

By: Billy Reisinger

Billy Reisinger — Wed, 28 May 2008 13:24:36 +0000

Douglas,
What exactly is the difference between what you outlined in the original article, specifically returning “that”, and doing this?
var Durable = function() { var a = 2; var b = 4; this.getA = function() { return a; } this.getB = function() { return b; } }
TIA,
Billy

By: Douglas Crockford

Douglas Crockford — Sun, 25 May 2008 23:03:22 +0000

There are no private methods in the prototype. All members, including all methods, are public.

By: Simon

Simon — Sun, 25 May 2008 22:58:04 +0000

Is there any mechanism for protecting private methods defined on the prototype of an object?

By: Joey Hurst

Joey Hurst — Sun, 25 May 2008 15:55:07 +0000

Douglas: Thanks for the reply.

Re Kerckhoffs’ Principle: definitely agree.

I should have chosen the variable name “secret” more carefully, perhaps calling it “private,” or simply “state.” The point was that one has to be careful not to expose references to private variables by one means or another, as this will allow a third party to manipulate the durable object’s state directly. As you mentioned, projects like Caja and ADSafe can address (pun intended) these additional concerns.

By: Douglas Crockford

Douglas Crockford — Sun, 25 May 2008 15:08:43 +0000

Peter,

Your security cannot depend on your global variables if the attacker has access to your global variables, including your global functions and constructors. An attacker can trivially replace your functions with his.

Try your attack under ADsafe. The attacker does not get access to your global durable function. The attacker does not get access to the DOM so he cannot examine the script tags. The attacker does get access to the ADSAFE object which could contain functions that facilitate interwidget communication, including the exchange of durable objects.

By: Douglas Crockford

Douglas Crockford — Sun, 25 May 2008 13:40:02 +0000

The Kerckhoffs’s Principle tells us that we should not be putting secrets in the source of the programs, and we should not be inconvenienced by the enemy reading the source of our programs.