Show HN: So.ciety, an end-to-end encrypted social network

Re:Show HN: So.ciety, an end-to-end encrypted social network by tptacek on Wednesday December 03, 2014 @12:02PM (#8694844)

No, you can't do that, because browser Javascript lacks a mechanism to segregate one "module" from another. In fact, any page that merely populates the DOM can override any security decision made by any Javascript file.

This idea comes up a lot, and nobody's ever explained to me a workable method for doing an integrity check of the entire Javascript runtime associated with a specific site. It's not as easy to do as it sounds.

[ Parent | on HN ]

Re:Show HN: So.ciety, an end-to-end encrypted social network by evv on Wednesday December 03, 2014 @01:46PM (#8695573)

You're right, but these sorts of browser apps will continue to be made because of the convenience.

The cheapest browser-app integrity check that I know of is shipping the dev code, complete with source maps. Allow anyone to read and debug what is going on inside your app.

[ Parent | on HN ]

Re:Show HN: So.ciety, an end-to-end encrypted social network by tptacek on Wednesday December 03, 2014 @02:38PM (#8695869)

That doesn't work either, because the app users read can be totally different than the app that ends up running the next time the DOM updates itself in the background.

See? "Fun" problem.

[ Parent | on HN ]