Re:Show HN: Password-protect a static HTML page
by yoble on Wednesday June 14, 2017 @02:27PM
(#14554838)
Oops thanks, that should be fixed - the generating page now gets its libraries from CDNs.
I'll probably look into adding Subressource Integrity checks for the other two as well.
Re:Show HN: Password-protect a static HTML page
by joshu on Wednesday June 14, 2017 @02:56PM
(#14555095)
It is also a threat if your DNS is compromised.
Re:Show HN: Password-protect a static HTML page
by a3_nm on Wednesday June 14, 2017 @05:28PM
(#14556266)
Not when fetching over HTTPS.
Re:Show HN: Password-protect a static HTML page
by snakeanus on Wednesday June 14, 2017 @06:27PM
(#14556605)
The CA system is extremely broken, it won't protect you from a state actor. Also TLS + DANE is useless if the DNS is compromised.
Re:Show HN: Password-protect a static HTML page
by acdha on Wednesday June 14, 2017 @07:22PM
(#14556800)
That's a bit too much hyperbole to be useful: yes, a state which runs a trusted CA is a threat (at least for sites which don't use key-pinning) but there are a ton of other things you're at risk for that way like SMS-based auth and the police or black bag squad paying you a visit. Describing the CA model as extremely broken because it doesn't handle an out-of-scope threat doesn't help anyone change their behavior to avoid it.
https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
It looks like the developer for this page copied the CDNJS links at some point but didn't do so consistently and later commented out the SRI portion of the jQuery tag: