Re:OpenPGPjs has passed an independent security audit
by toomuchtodo on Thursday August 16, 2018 @11:40AM
(#17775605)
> No, because the provider would be in the position to change the SRI hashes. Sub Resource Integrity protects you against malicious CDNs and so on, but needs a non-compromised HTML page to provide correct hashes.
Can you not trust the originating site to serve non-compromised HTML if using HSTS and a trusted local certificate store (eliminating MITM as an attack vector)?
Re:OpenPGPjs has passed an independent security audit
by detaro on Thursday August 16, 2018 @11:43AM
(#17775632)
Not if the originating site is the potential attacker, which was the initial scenario: Protonmail sending you page that leaks your decrypted mail to them.
Re:OpenPGPjs has passed an independent security audit
by jnbiche on Thursday August 16, 2018 @11:33AM
(#17775535)
There was a way to make a permanent site installation on most browsers using HTML5 appcache, which even the web host couldn't update, but that API is deprecated in favor of the service worker's Cache API.
It's not clear to me that the Cache API offers the same level of security guarantee.
Re:OpenPGPjs has passed an independent security audit
by tlrobinson on Thursday August 16, 2018 @12:07PM
(#17775860)
> It's not clear to me that the Cache API offers the same level of security guarantee.
Last I checked it seemed there wasn’t any way to prevent the service worker itself from being updated.
You could however probably provide a signed entry point via a webextension or so and a an audit trail via a trusted distribution plattform, like addons.mozilla.org. Are there apps which use a mechanism like this?