News for hackers. Stuff that matters.

A comment on Optimizing HTTPS performance. Parent comment

Re:Optimizing HTTPS performance by theandrewbailey on Sunday January 31, 2016 @04:08PM (#11008075)
It's called Subresource Integrity. I just implemented it on my blog yesterday. It only works on CSS and JS, but image support is supposedly coming. I highly doubt that it would be a good idea for hyperlinks.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

[ Parent | on HN ]
Re:Optimizing HTTPS performance by geofft on Sunday January 31, 2016 @05:11PM (#11008349)
Worth noting: subresource integrity doesn't currently change the mixed-content algorithm at all. An HTTPS site can't load an HTTP + SRI script.

It's useful for increasing the status quo on HTTP pages, or for defense-in-depth on HTTPS pages, but it doesn't actually enable you to do anything you couldn't before.

[ Parent | on HN ]
Re:Optimizing HTTPS performance by majewsky on Sunday January 31, 2016 @04:15PM (#11008103)
I would argue it's a bad idea for images already. Images give away a lot about the type of content that you're viewing, which is possibly sensitive information.

Consider, for example, a Chinese computer connecting to Wikipedia over HTTPS, which then downloads an image over HTTP without S that is clearly related to the Tiananmen massacre.

[ Parent | on HN ]
Re:Optimizing HTTPS performance by theandrewbailey on Sunday January 31, 2016 @04:32PM (#11008180)
I'm not saying that it's a replacement for HTTPS. Nothing stops you from using SRI hashes for HTTPS content. If you're concerned over censorship, you should be using HTTPS, period. SRI is more concerned about bad CDN content. Your CDN can use HTTPS, but your server's page says what the hash should be, so if your CDN goes rouge, things will start breaking.
[ Parent | on HN ]