OpenPGPjs has passed an independent security audit

Re:OpenPGPjs has passed an independent security audit by Something1234 on Thursday August 16, 2018 @03:26PM (#17777749)

Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server side, meaning you can't trust the html, even if the server is who it says it is.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by SahAssar on Thursday August 16, 2018 @03:35PM (#17777810)

Right, but what I'm saying is that you don't need the loader. Just have a bookmarklet with html that contains script tags with SRI. The loader is just another step you need to trust.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by dividuum on Thursday August 16, 2018 @05:04PM (#17778402)

That does indeed work. Pretty neat. For anyone trying, here is basically all you need:

  data:text/html,<script crossorigin="anonymous" integrity="..." src="...">

In total that should be a lot smaller than the linked codegolf answer.

[ Parent | on HN ]