News for hackers. Stuff that matters.

A comment on If your site does not use HTTPS, Rostelecom will insert pro-war propaganda in it.

Re:If your site does not use HTTPS, Rostelecom will insert p... by memen on Wednesday July 06, 2022 @10:42AM (#32001725)
In cryptography there is the clear difference between encrypting and signing (Confidentiality and Integrity). Is this distinction possible on a webserver/browser? I.e. No encryption, no signing -> HTTP Encryption and signing -> HTTPS No encryption, signing -> ? What about public information (not confidential) that needs verification (yes integrity)?
[ Parent | on HN ]
Re:If your site does not use HTTPS, Rostelecom will insert p... by paulhodge on Wednesday July 06, 2022 @11:37AM (#32002532)
Don’t think it exists for the HTML document. HTTPS works fine for public & unconfidential things. For verifying page resources there is a newish feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subres... .
[ Parent | on HN ]
Re:If your site does not use HTTPS, Rostelecom will insert p... by norhi999 on Saturday July 09, 2022 @05:47AM (#32033446)
Something like this maybe: https://tools.ietf.org/id/draft-hallambaker-httpintegrity-02... although it's an unimplemented draft.
[ Parent | on HN ]