News for hackers. Stuff that matters.

A comment on The new ProtonMail has passed its independent security audit. Parent comment

Re:The new ProtonMail has passed its independent security audit by ryebit on Sunday July 18, 2021 @12:29PM (#27874209)
Deploying via IPFS might also work? Though it'd require having a trustworthy backend storing state ... or I suppose auditing to ensure backend can't inject anything malicious into client layer.

From what I understand, some cryptocurrency DApps like Uniswap[0] are using this route.

[0] https://github.com/Uniswap/uniswap-interface

[ Parent | on HN ]
Re:The new ProtonMail has passed its independent security audit by dane-pgp on Sunday July 18, 2021 @12:39PM (#27874308)
Deploying via IPFS might work indeed, but you're then either reliant on a gateway or have to run IPFS yourself locally. I know that Brave now supports IPFS, but for most people a more lightweight solution would be to install the Signed Pages extension for Chrome or Firefox.[0]

I'm not sure if you actually need a trustworthy backend, or rather, if the frontend is encrypting its state before sending it to the backend, then the worst a malicious backend can do is delete or replay your data. By including timestamps and replicating your state to multiple independent backends, that risk can be largely mitigated.

[0] https://github.com/tasn/webext-signed-pages

[ Parent | on HN ]