COWL, a New Web Privacy Tool, to Arrive for Chrome and Firefox

A group of researchers is making news for building a new web privacy system for the Google Chrome and Mozilla Firefox browsers that more efficiently handles JavaScript code among other tasks. In a paper introduced this week in conjunction with the Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, the researchers reported that 59 per cent of the biggest one million websites, and 77 per cent of the top 10,000 websites,  incorporate jQuery, a tool that has been preyed on by hackers.

The researchers' new tool is dubbed COWL, and it will be available as a free download starting October 15. 

Confinement with Origin Web Labels (COWL) works with the Firefox and Chrome browsers and aims to prevent websites from leaking sensitive information. The team behind COWL includes researchers from University College London, Stanford Engineering, Google, Chalmers and Mozilla Research.

Co-author Professor Brad Karp (UCL Computer Science), said: "COWL achieves both privacy for the user and flexibility for the web application developer. Achieving both these aims, which are often in opposition in many system designs, is one of the central challenges in computer systems security research."

"The new system provides a property known as 'confinement' which has been known since the 1970s, but proven difficult to achieve in practical systems like web browsers. COWL confines JavaScript programs that run within the browser, such as in separate tabs. If a JavaScript program embedded within one web site reads information provided by another web site – legitimately or otherwise – COWL permits the data to be shared, but thereafter restricts the application receiving the information from communicating it to unauthorised parties. As a result, the site that shares data maintains control over it, even after sharing the information within the browser."

We'll follow up on COWL and how it works as it becomes available. Many browser users will want to get it, and there are reports that it will soon work with the Safari browser as well.