Trust Origin and Establishment with JavaScript Applications

Ville Rantala
Abstract:Applications written with Web technologies are a growing trend. Web technologies include the JavaScript programming language which has become popular due to its support in modern Web browsers. Today JavaScript is also used to implement installable stand-alone applications in addition to Ajax-style programming. An example of such stand-alone applications are widgets that conform to the W3C Widgets 1.0 specification. Security is a key concern with these kind of applications because they often have an access to sensitive and valuable information through Web or platform interfaces. One of the main challenges is to determine how to establish trust towards an application. Applications can be benevolent or malicious, but the difference is hard to tell by an end-user. Digital signatures and certificates have been used to help end-users in making a trust decision and to delegate trustworthiness evaluation to trusted parties. These mechanisms have drawbacks that make application development , distribution and adoption more difficult. In this thesis a new trust establishment mechanism is proposed that helps to deal with the drawbacks. It is based on the Domain Name System and utilizes the originating domain of applications. An implementation of the proposed mechanism is provided on top of the W3C Widgets 1.0 specification and the implementation is evaluated against design requirements. The new mechanism is recognized to bring many benefits to the different parties of the widget ecosystem.
What problem does this paper attempt to address?