Re:Protecting sites from Cryptojacking with CSP and SRI
by Scott_Helme_ on Sunday February 11, 2018 @02:11PM
(#16354203)
There is/was discussion in the standards body of using the SRI hash for exactly this purpose. It sounds really promising but iirc there was a privacy kink to work out.
[ Parent
| on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI
by sago on Sunday February 11, 2018 @02:44PM
(#16354350)
You could potentially tell whether someone has been to a third-party site.
Person goes to a porn site, get's file #A.
Spying site, offers file #A, but never delivers it.
If a person already has #A (i.e. doesn't request it), spy site knows they've been to porn site.
Re:Protecting sites from Cryptojacking with CSP and SRI
by stordoff on Sunday February 11, 2018 @11:42PM
(#16356588)
Could you limit it to widely used libraries? e.g. browser ships with the last N versions of jQuery etc., and avoids the request if it's a known hash. If it's widely used, it seems like the amount of information leaked would be low, and if the browser _always_ ships with it (rather than caching on first use), it would only identify the browser and not browsing history anyway.
As a bonus, developers could use it knowing that there is much less likely to be a performance hit from fetching it.