News for hackers. Stuff that matters.

A comment on Proton.B: What this Mac malware does. Parent comment

Re:Proton.B: What this Mac malware does by fulafel on Sunday May 14, 2017 @10:49AM (#14335840)
This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so: <a href="..." integrity="...">
[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by fulafel on Monday May 15, 2017 @01:18AM (#14339327)
Correcting myself: looks like the SRI spec hasn't included the <a> element in the list of supported elements, though it has a mention that it might be supported in a future version :(
[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by nerdponx on Sunday May 14, 2017 @11:08AM (#14335900)
How does the browser know what hash algo to use?
[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by CharlesW on Sunday May 14, 2017 @11:22AM (#14335952)
https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

"As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."

[ Parent | on HN ]