Re:Show HN: PubKey – Communicate Privately in Anonymous Publ...
by jstanley on Monday July 18, 2022 @06:39AM
(#32136607)
It's good that you're taking steps to make sure your tool is completely client-side. Good job!
You're loading bootstrap.bundle.min.js from jsdelivr. This opens you up to an unnecessary supply-chain attack (i.e. if jsdelivr becomes compromised or malicious, it can ship a modified version that exfiltrates user data). You're also loading crypto-js.min.js from cloudflare, which has the same problem.
I would recommend moving both of those 2 script files to your own domain so that the user is only trusting 1 site instead of 3.
EDIT: I just noticed you are using subresource integrity to mitigate this problem. Never mind then, carry on!
You're loading bootstrap.bundle.min.js from jsdelivr. This opens you up to an unnecessary supply-chain attack (i.e. if jsdelivr becomes compromised or malicious, it can ship a modified version that exfiltrates user data). You're also loading crypto-js.min.js from cloudflare, which has the same problem.
I would recommend moving both of those 2 script files to your own domain so that the user is only trusting 1 site instead of 3.
EDIT: I just noticed you are using subresource integrity to mitigate this problem. Never mind then, carry on!