News for hackers. Stuff that matters.

A comment on China's Man-On-the-Side Attack on GitHub. Parent comment

Re:China's Man-On-the-Side Attack on GitHub by e40 on Tuesday March 31, 2015 @10:57AM (#9296632)
On a technical point, is there a reason that javascript doesn't tend to be signed in any way?

A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

[ Parent | on HN ]
Re:China's Man-On-the-Side Attack on GitHub by ethbro on Tuesday March 31, 2015 @11:14AM (#9296797)
> A good point. I think it's convenience that we don't do it, but I'd hope we move in that direction. It seems like a prudent move.

After a bit of Googling, (a) http://stackoverflow.com/questions/1368164/javascript-code-s... (b) http://www-archive.mozilla.org/projects/security/components/...

It seems it's simultaneously too difficult to do without ECMA spec support & would require a certificate chain anyway. And if you're running a cert chain infrastructure, why not use the one that already exists and run TLS?

Other side thought: with regards to the usefulness & impracticality of cert pinning, has any work been done on systems specifically designed to target low % injection systems? If 1/10 visitors gets the poisoned page, then it seems you'd have a 9/10 chance to pull a good page for comparison & verification if you (or a proxy you trust) made another request from a different IP.

[ Parent | on HN ]