8 ms·
I was reading about WebCrypto API lately and read negative view about it [1]. What I understand is that with HTTPS one of the problems is having private key onl
by hawski 11y ago
I was reading about WebCrypto API lately and read negative view about it [1]. What I understand is that with HTTPS one of the problems is having private key online. In case of break-in someone can just modify served files and now forged files are served. It would be good to have static files signed with separate signing key just for static content. Then private key can be offline and forgery can be easily detected.
Is there something like that in case of offline web apps?
[1] http://tonyarcieri.com/whats-wrong-with-webcrypto http://tonyarcieri.com/whats-wrong-with-webcrypto
- nicois 11y agoThat would just make it easier for a MITM (and maybe others) to spoof all your static content with legitimate signatures.
- hawski 11y agoNo because your signature should be signed by key registred at CA. It would be second level certificate for your domain. And you would still serve your files via HTTPS. So that would give you second line of defense.