Hails: Protecting Data Privacy in Untrusted Web Applications

• Modern extensible web platforms like Facebook andYammer depend on third-party software to offer a richexperience to their users. Unfortunately, users running athird-party “app” have little control over what it does withtheir private data. Today’s platforms offer only ad-hocconstraints on app behavior, leaving users an unfortunatetrade-off between convenience and privacy. A principledapproach to code confinement could allow the integration of untrusted code while enforcing flexible, end-to-endpolicies on data access. This paper presents a new webframework, Hails, that adds mandatory access control anda declarative policy language to the familiar MVC architecture. We demonstrate the flexibility of Hails throughGitStar.com, a code-hosting website that enforces robust privacy policies on user data even while allowing untrusted apps to deliver extended features to users.

Subject headings

NATURVETENSKAP  -- Data- och informationsvetenskap -- Språkteknologi (hsv//swe)

NATURAL SCIENCES  -- Computer and Information Sciences -- Language Technology (hsv//eng)

NATURVETENSKAP  -- Data- och informationsvetenskap (hsv//swe)

NATURAL SCIENCES  -- Computer and Information Sciences (hsv//eng)

NATURVETENSKAP  -- Data- och informationsvetenskap -- Systemvetenskap, informationssystem och informatik (hsv//swe)

NATURAL SCIENCES  -- Computer and Information Sciences -- Information Systems (hsv//eng)

Publication and Content Type

kon (subject category)

ref (subject category)