The web interface should be radically refactored

Authors:
John R. Douceur;Jon Howell;Bryan Parno;Michael Walfish;Xi Xiong
Affiliations:
Microsoft Research Washington;Microsoft Research Washington;Microsoft Research Washington;University of Texas at Austin, Texas;Penn State University, Pennsylvania
Venue:
Proceedings of the 10th ACM Workshop on Hot Topics in Networks
Year:
2011

Citing 19
Cited 3

Toward real microkernels

Communications of the ACM
Aligning Security and Usability

IEEE Security and Privacy
A Nitpicker's guide to a minimal-complexity secure GUI

ACSAC '05 Proceedings of the 21st Annual Computer Security Applications Conference
A Safety-Oriented Platform for Web Applications

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Slinky: static linking reloaded

ATEC '05 Proceedings of the annual conference on USENIX Annual Technical Conference
Design of the EROS trusted window system

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
A Systematic Approach to Uncover Security Flaws in GUI Logic

SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
AjaxScope: a platform for remotely monitoring the client-side behavior of web 2.0 applications

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
An analysis of browser domain-isolation bugs and a light-weight transparent defense mechanism

Proceedings of the 14th ACM conference on Computer and communications security
Secure Web Browsing with the OP Web Browser

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Isolating web programs in modern browser architectures

Proceedings of the 4th ACM European conference on Computer systems
Native Client: A Sandbox for Portable, Untrusted x86 Native Code

SP '09 Proceedings of the 2009 30th IEEE Symposium on Security and Privacy
seL4: formal verification of an OS kernel

Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles
Leveraging legacy code to deploy desktop applications on the web

OSDI'08 Proceedings of the 8th USENIX conference on Operating systems design and implementation
The multi-principal OS construction of the gazelle web browser

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Trust and protection in the Illinois browser operating system

OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
Rethinking the library OS from the top down

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
I Still Know What You Visited Last Summer: Leaking Browsing History via User Interaction and Side Channel Attacks

SP '11 Proceedings of the 2011 IEEE Symposium on Security and Privacy
Atlantis: robust, extensible execution environments for web applications

SOSP '11 Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles

TreeHouse: JavaScript sandboxes to helpWeb developers help themselves

USENIX ATC'12 Proceedings of the 2012 USENIX conference on Annual Technical Conference
Extending the web to support personal network services

Proceedings of the 28th Annual ACM Symposium on Applied Computing
Embassies: radically refactoring the web

nsdi'13 Proceedings of the 10th USENIX conference on Networked Systems Design and Implementation

Quantified Score

Hi-index	0.00

Visualization

Abstract

The Web API conflates two conflicting goals: serving developers by supporting a wide and growing suite of functionality, and providing applications with an isolated execution environment. We propose to split the API into two levels of interface: a low-level interface that governs the relationship between the application and the browser, and a set of high-level interfaces that govern the relationship between the application and its developer. We delineate a tiny set of properties needed by the low-level interface. We argue that this restructuring provides significant benefit to both developers and users.