Tanker: End-to-End Encryption SDK for JavaScript

Re:Tanker: End-to-End Encryption SDK for JavaScript by the8472 on Wednesday May 22, 2019 @11:48AM (#19982444)

You would still have to combine SRI with a fairly strong CSP to avoid any code execution except SRI-covered stuff.

It would be a good PoC I guess, but not practical yet for most people.

[ Parent | on HN ]

Re:Tanker: End-to-End Encryption SDK for JavaScript by e12e on Wednesday May 22, 2019 @04:30PM (#19985120)

We're talking about a html file that's basically:

  <html>
  <script
    src=example.cdn/app.js (SRI hash) />
  </html>

If your app.js go including unknown fonts and js etc... Then, yeah, you've got problems.

[ Parent | on HN ]

Re:Tanker: End-to-End Encryption SDK for JavaScript by AgentME on Wednesday May 22, 2019 @05:19PM (#19985636)

CSP would only be necessary if the SRI-covered stuff had bugs that let it accidentally load unverified resources. (To be clear, I think CSP is a necessary defense-in-depth measure for everyone, but this case doesn't uniquely require it.)

[ Parent | on HN ]