News for hackers. Stuff that matters.

A comment on End-to-end encryption in the browser. Parent comment

Re:End-to-end encryption in the browser by kybernetikos on Monday March 23, 2020 @12:29PM (#22665581)
Subresource Integrity allows the HTML file to insist that the js file hasn't changed. I guess it would be possible to download and run the html file from your own machine.

Alternatively, it would be possible to create a service worker that uses a local copy and makes much more of a deal about files changing - it could always confirm changes with the user before allowing a change. Security sensitive apps should probably be doing this.

[ Parent | on HN ]
Re:End-to-end encryption in the browser by tatersolid on Monday March 23, 2020 @11:02PM (#22671466)
JS allows overriding overriding any object or method with separately loaded code. So even your “trusted” code could be compromised by separate “trusted” code.

Even native app packagers and languages can suffer from this when loading libraries dynamically (from search-path or symlink manipulation for example).

[ Parent | on HN ]