For example you have email web app with E2E encryption. With client side E2E encryption you don't need to trust server with your data, but you definitely have to trust client.
But here comes problem, because client is distributed from server you don't want to trust and each page refresh can download new code from server.
You need somehow to check if client is not made malicious by attacker or whoever.
With code signing you can do two things: - check if code was signed by developer and block downloading new source if not - or even more (advanced), verify that that signed build you are downloading is actually build, which is published somewhere and can be audited.
Over years people have been asking for adding some sort of code signing for web apps, like native apps have.But still I see no movement in this direction, although now we have plenty web apps focused on security and encryption. And every time someone tell you, that there is risk with trusting downloaded source code from server.But why at least some browsers (or multiple forks of them) haven't...
You build app around specific free API, for example some social media. Without this API, your app is useless as you can't just easily switch providers like with some weather app.What is your risk plan, when some day you could be cut off from accessing API?Do you make it modular enough, so when time come, you just switch to another API?I'm asking, because for me, it always seemed like a big risk...
This is of course not very user friendly, but might have some use, if you can't or don't want to have running server 24/7 at your home or secure location.
But I don't know, if any browser will let offline apps live for indefinite time.
I was even playing with code signing web apps with help of service workers, which was not bullet proof, but better than nothing. Ultimately it failed on the fact, that you could not prevent/cache/block update of actual service worker file.
Another dirty workaround could be using dynamic one time address for serving service worker only on first attempt and then browser would get 404 on attempts to update service worker. Again, not very useful as you are at mercy that browser won't just purge such "broken" worker.
Hello, I have been developing self hosted CalDAV calendar Bloben (https://bloben.com), which is now available also as standalone Electron desktop client for Linux and Windows.It is using same client and server code base with some changes like:- switching from PostgreSQL database to SQLite- requests are handled with IPC- no account management, just single userWhy Electron app when there is...
I am trying to find way, how to make web apps more secure with code signing and verifying source code without browser extensions just by using service workers.Concept is, that service worker will verify any fetched file with signing key and prevent malicious updates (from hacked server, etc.). This is working great till it comes to actual service worker file.Bad actor can just change SW file,...
Repositories are also in Readme under "Source" https://github.com/nibdo/bloben-app
Hello all,I have been working on a self hosted CalDAV calendar client Bloben https://github.com/nibdo/bloben-appThis is mostly an alternative to other web clients like great AgenDAV with some additional features I wanted to use like email invites, alarms, webcalendars, etc.You can play with demo (limited to read access) here: https://demo.bloben.com/api/v1/users/login-demo?username=dem...In the...