News for hackers. Stuff that matters.

A comment on Tanker: End-to-End Encryption SDK for JavaScript. Parent comment

Re:Tanker: End-to-End Encryption SDK for JavaScript by e12e on Wednesday May 22, 2019 @11:31AM (#19982276)
Subresource integrity can help a bit. You still need to bootstrap from a trusted source though (eg a minimal index.html stored locally). And at that point, you really are back to figuring out a way to distribute a "known good" piece of software.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Ed: it might, for example be easier to email an attached minimal html file, than a 50mb electron app (multiply by 5 for working on the five major platforms; windows, Linux, Macos, Android and ios). That email might be internal, or signed however you usually sign mails (gpg, s/mime). Or you could host it on a minimal, secure webserver that only served static files over ssl etc

[ Parent | on HN ]
Re:Tanker: End-to-End Encryption SDK for JavaScript by cdata on Wednesday May 22, 2019 @11:48AM (#19982438)
A known good entry point could be delivered over a content-addressed medium like IPFS, and if you layer on SXG the consumer might still be able to validate the origin of the entry point.

https://docs.ipfs.io/guides/concepts/

https://github.com/ipfs/in-web-browsers/issues/121

[ Parent | on HN ]
Re:Tanker: End-to-End Encryption SDK for JavaScript by the8472 on Wednesday May 22, 2019 @11:48AM (#19982444)
You would still have to combine SRI with a fairly strong CSP to avoid any code execution except SRI-covered stuff.

It would be a good PoC I guess, but not practical yet for most people.

[ Parent | on HN ]
Re:Tanker: End-to-End Encryption SDK for JavaScript by e12e on Wednesday May 22, 2019 @04:30PM (#19985120)
We're talking about a html file that's basically:

  <html>
  <script
    src=example.cdn/app.js (SRI hash) />
  </html>
If your app.js go including unknown fonts and js etc... Then, yeah, you've got problems.
[ Parent | on HN ]
Re:Tanker: End-to-End Encryption SDK for JavaScript by AgentME on Wednesday May 22, 2019 @05:19PM (#19985636)
CSP would only be necessary if the SRI-covered stuff had bugs that let it accidentally load unverified resources. (To be clear, I think CSP is a necessary defense-in-depth measure for everyone, but this case doesn't uniquely require it.)
[ Parent | on HN ]