Re:OpenPGPjs has passed an independent security audit
by toomuchtodo on Thursday August 16, 2018 @11:40AM
(#17775605)
> No, because the provider would be in the position to change the SRI hashes. Sub Resource Integrity protects you against malicious CDNs and so on, but needs a non-compromised HTML page to provide correct hashes.
Can you not trust the originating site to serve non-compromised HTML if using HSTS and a trusted local certificate store (eliminating MITM as an attack vector)?
Re:OpenPGPjs has passed an independent security audit
by detaro on Thursday August 16, 2018 @11:43AM
(#17775632)
Not if the originating site is the potential attacker, which was the initial scenario: Protonmail sending you page that leaks your decrypted mail to them.
Can you not trust the originating site to serve non-compromised HTML if using HSTS and a trusted local certificate store (eliminating MITM as an attack vector)?