3 ms·

Is it worse than just Https? I'm not advertising the feature loudly, I just want to keep nosy sysadmins on corporate networks with https inspection out of priva

Is it worse than just Https? I'm not advertising the feature loudly, I just want to keep nosy sysadmins on corporate networks with https inspection out of private conversations. It obviously can be broken by NSA types if they want to actively alter traffic, but passive monitoring should be harder. Also this forces the attackers hand, an attack against this system can be detected if you want to spend the time comparing hashes.

forgotpwtomain 10y ago
> Also this forces the attackers hand, an attack against this system can be detected if you want to spend the time comparing hashes. You could have an extension which checks the hash of the js/html payload against a publicly known and signed hash prior to running and rejects it otherwise. It's still browser crypto but potentially you do better than 'everything is broken if the ssl session is hijacked'.