News for hackers. Stuff that matters.

A comment on OpenPGPjs has passed an independent security audit. Parent comment

Re:OpenPGPjs has passed an independent security audit by diggan on Thursday August 16, 2018 @11:15AM (#17775339)
If you can change out the JS payload, you can probably also swap out the HTML which supposedly "secures" it.

If the users had the option of "locking" a JS version with the Subresource Integrity attribute that they are currently using, it might help.

[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by eli on Thursday August 16, 2018 @11:31AM (#17775505)
Wouldn't you also need to lock down all the UI code and everything that interacts with the library?
[ Parent | on HN ]