So these are awesome and they are fantastic tools in order to protect
against one of the risks you raised with keyloggers,
which is external scripts being maliciously modified.
Yep,
you'd advise any merchant running a website to do SRI for any
third-party content they're pulling into a site.
So, SRI is really the no-brainer.
SRI is the easiest possible one to do it on.
I don't care whether you're a merchant running a website or
whether you're a blogger running a website.
So, it's super, super simple regardless of the nature of your site,
and in fact, you can go to srihash.
org, you can take the URL of the JavaScript file you're embedding,
you can put it in here, say hash, and you get the tag generated for you.
Brilliant.
Which is super cool.
So that was very, very easy.
CSP is also super awesome as well.
A little bit more work because you've got to white-list all the sources
that you're actually going to accept things from,
but enormously powerful, and again,
it's like a free thing built into the browser.
It is.
So, if in my CSP on my merchant's website,
I made sure I didn't white-list criminal.
com, where the criminal JavaScript is coming from, I'm going to be okay.
You are so long as you're not white-listing another hostname,
which then allows people to upload their own arbitrary content onto.
So, for example,
if you are allowing any gist to be loaded and someone put it into a gist,
but we can filter down our CSP to say a path of gists,
so in fact, if you go to my blog today,
you'll see that I allow gists from the path that is Troy Hunt.
So unless I put my own malicious script in the Troy Hunt,
which I'm not going to do, it's my blog,
yeah, it would be protected.