End-to-end encryption in the browser

Re:End-to-end encryption in the browser by rcxdude on Monday March 23, 2020 @11:58AM (#22665235)

Yes, but there's no provision in the browser to do these kinds of integrity checks. If the browser isn't verifying it there's no point in adding any of this info, because it can be substituted covertly. In principle such 'version-pinning' could be added to the browser, but no-one has done so yet.

[ Parent | on HN ]

Re:End-to-end encryption in the browser by franky47 on Tuesday March 24, 2020 @07:48AM (#22674043)

Agreed. Even subresource integrity [1] does not help here, because if the HTML is compromised, then everything else can be too.

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

[ Parent | on HN ]