Security Concerns for Browser Games in Iframes

You can use JSONP. Its not so hard to write a little function yourself, here is a little example from one of my sites;

function ecbCreateScript(url, callback) {
    var head = document.getElementsByTagName('head')[0];
    var script = document.createElement('script');
    script.type = 'text/javascript';
    script.src = url;

    script.onreadystatechange = loadEcbForm;
    script.onload = loadEcbForm;

    // fire the loading
    head.appendChild(script);
}

I imagine the risks are the same as using any unsigned executable. The reason that it's okay to download the application over an intranet is that you trust the network hardware (and people who have access to that hardware) that serves you the file. When you ask, "Server foo.local, please send me bar.exe," you know that foo.local is a trustworthy machine, and all the routers and switches between you and foo.local are also trustworthy.

In an Internet distribution setup, the user asks foo.com to serve bar.exe. The user has no good way to be sure that:

• foo.com hasn't tampered with the file
• his DNS records haven't been tampered with to keep him from talking to the right host
• that an attacker on his home network hasn't ARP poisoned his router to redirect and alter his traffic

The user gets the file from a fundamentally untrustworthy source. Digital signatures are a way to provide trust even when the distributing source is not trustworthy. The signature is a sealed guarantee to the end recipient that this file is exactly the one that was produced by the original signer.

Ultimately, the risk is not that the file will somehow be less trustworthy when it reaches the user; the problem is that the user may not ever receive your file, but will instead be unknowingly provided with a different file. Digital signatures allow you to mark your files as uniquely yours, in a way that can be verified by the end user. Any malicious agent who tries to provide a malicious lookalike will not be able to fake your signature. However, if you don't have a signature in the first place (or, more importantly, the user is not expecting a signature), then there's no way to verify he got the right file.