So, Troy,
how do we stop criminals getting their JavaScript to
execute in our customers' browsers?
All right, so good lead-in,
because it gets us back to the blog post I was just talking about before,
and this is where we were talking about the browser situation.
Now in the title here I talk about SRI and CSP,
which is sub-resource integrity and content security policy.
And a really great way of demonstrating this is to take a website that is
using BrowseAloud and to show you what they do now,
because they have fixed this.
And that website is the NHS in Scotland.
So this is your National Health Service here in the,
I know you're not Scottish, but --- We're in the UK.
You're the other side of the world to me, this part of the world.
So the NHS is using BrowseAloud,
we can see the big B up in the top left-hand corner.
And BrowseAloud is actually accessibility tooling,
so people who are maybe visually impaired,
it helps you read the content on the page.
Now what I'm going to do is just jump into the source code of this page,
and I'll zoom it in a little bit so we can see things a bit more clearly.
Search for ba.
js because this is the BrowseAloud script,
and we can see down here, we've got a script tag,
the source is still on the BrowseAloud host name,
so it's pulling this file in from their web server.
What's a little bit different about this script tag is we can see
that there is an integrity attribute on here.
And we can see integrity sha256 and then there's a sha256 hash on there.
There's also a sha384 hash and a sha512 hash.
And this is called sub-resource integrity.
And what it means is that ba.
js file, a known good copy of that, so one that we trust,
creates hashes of these three kinds,
and they've been a little bit redundant here in having different hash types.
And what the browser does when it sees this is that when it downloads ba.
js from the BrowseAloud website and it sees that there's an integrity attribute,
it will hash that file and it will compare it to,
say, the sha384 hash, makes sure it's not the same.
So what this does is it means we can have absolute confidence
that the script file being loaded from somewhere else is
exactly the one that we expect it to be.
Anyone puts their crypto-miner in the head of this or
their keylogger via payment card form, hash is going to be different.
So this is really, really awesome, and in fact,
I'm really happy to see the NHS doing this because it solves this problem.