负责的JavaScript代码交付
Accountable Javascript Code Delivery
摘要：
互联网是Web应用程序的主要分发平台，但Web没有有效的透明度和审计机制。由于Web应用程序的短暂性，访问网站的客户端无法保证今天收到的代码与昨天相同，或者与其他访问者收到的代码相同。尽管在Web安全方面取得了进展，但在Web应用程序在浏览器中呈现之前对其进行审计仍然具有挑战性。我们提出Accountable JS，一个浏览器扩展和选择协议，负责在网页上提供活动内容。我们原型我们的协议，正式建模其安全属性与Tamarin证明，并评估其兼容性和性能影响的案例研究，包括WhatsApp Web，AdSense和Nimiq。问责制开始大规模部署，Meta最近宣布代码验证可供所有20亿WhatsApp用户使用，但很少有对此类协议的正式分析。我们使用Tamarin Prover正式建模代码验证，并将其属性与我们的Accountable JS协议进行比较。我们还比较了Code Verify和Accountable JS扩展对WhatsApp Web性能的影响。
英文摘要：
The internet is a major distribution platform for web applications, but there are no effective transparency and audit mechanisms in place for the web. Due to the ephemeral nature of web applications, a client visiting a website has no guarantee that the code it receives today is the same as yesterday, or the same as other visitors receive. Despite advances in web security, it is thus challenging to audit web applications before they are rendered in the browser. We propose Accountable JS, a browser extension and opt in protocol for accountable delivery of active content on a web page. We prototype our protocol, formally model its security properties with the Tamarin Prover, and evaluate its compatibility and performance impact with case studies including WhatsApp Web, AdSense and Nimiq. Accountability is beginning to be deployed at scale, with Meta's recent announcement of Code Verify available to all 2 billion WhatsApp users, but there has been little formal analysis of such protocols. We formally model Code Verify using the Tamarin Prover and compare its properties to our Accountable JS protocol. We also compare Code Verify's and Accountable JS extension's performance impacts on WhatsApp Web.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
