News for hackers. Stuff that matters.

A comment on OpenPGPjs has passed an independent security audit. Parent comment

Re:OpenPGPjs has passed an independent security audit by jrruethe on Thursday August 16, 2018 @01:03PM (#17776456)
These concepts are interesting:

https://codegolf.stackexchange.com/questions/18217/javascrip...

https://bitbucket.org/geraintluff/caution.js/

The idea is that a long data-uri containing hashes and a small loader function are bookmarked. The loader won't load the corresponding javascript unless the hashes match. The user only needs to verify the javascript once, then they can rely on their bookmark containing the hashes. If the server were to swap out the javascript, the bookmark would fail to load it.

[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by SahAssar on Thursday August 16, 2018 @02:05PM (#17777110)
Isn't that just SRI in a bookmarklet? With SRI you give the browser a hash and if the resource does not match it does not load.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by Something1234 on Thursday August 16, 2018 @03:26PM (#17777749)
Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server side, meaning you can't trust the html, even if the server is who it says it is.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by SahAssar on Thursday August 16, 2018 @03:35PM (#17777810)
Right, but what I'm saying is that you don't need the loader. Just have a bookmarklet with html that contains script tags with SRI. The loader is just another step you need to trust.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by dividuum on Thursday August 16, 2018 @05:04PM (#17778402)
That does indeed work. Pretty neat. For anyone trying, here is basically all you need:

  data:text/html,<script crossorigin="anonymous" integrity="..." src="...">
In total that should be a lot smaller than the linked codegolf answer.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by Sir_Cmpwn on Thursday August 16, 2018 @01:06PM (#17776485)
Oooh, that's very cool. Thanks for the links.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by xyzzy123 on Thursday August 16, 2018 @07:40PM (#17779308)
You might also like substack’s work on hyperboot.
[ Parent | on HN ]
Re:OpenPGPjs has passed an independent security audit by hahahihi on Thursday August 16, 2018 @05:42PM (#17778644)
if you send the datauri by email (webmail) and use it from there someone with phisical access to the computer wont be able to change it easily.
[ Parent | on HN ]