3 ms·
That isn't entirely true. You could easily develop a web extension that validated the hash of the scripts being sent down the wire. Then you'd have an equivalen
by darawk 11y ago
That isn't entirely true. You could easily develop a web extension that validated the hash of the scripts being sent down the wire. Then you'd have an equivalent security guarantee to a normal desktop client.
- deadmaildrop 11y agoOr you just inject your own payload and pad the payload until it has a hash collision with the original. At 128M hashes per second you can probably find a payload that works within a day. Since the hashes are published, usually, you know your target so it's just a matter of time.
- colejohnson66 11y agoYou do know how hard it would be to find a SHA-256 collision? We haven't even found /one/. Sure, if you used MD5, you could expect a collision, but SHA256?
- deadmaildrop 11y agoI've seen them. Just recently I had a short burst of collisions. It happens. Don't underestimate the resolve of someone who wants to grind an axe.
- darawk 11y agoLol, no. You have not seen a SHA256 collision. One has never been found, by anyone, ever.
- deadmaildrop 11y agoThanks for calling me a liar. I see the quality of people on this thread has suddenly dropped. So, stick with respectful discourse or keep it to yourself. You are clearly not in the industry, just another useless troll.