4 ms·
HTTPS not only protects against eavesdroppers: it also protects against from people manipulating the connection and replacing content (like swapping exe downloa
by AgentME 10y ago
HTTPS not only protects against eavesdroppers: it also protects against from people manipulating the connection and replacing content (like swapping exe downloads for infected executables). If untrusted caching-proxies are important, then there should be a new caching-proxy-compatible protocol which carries signed data without encrypting it, and browsers should communicate when it's in use.
- slim 10y agoSubresource Integrity is better suited for that use case http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/
- deleted 10y ago[deleted]
- xtian 10y agoSRI is meaningless on an insecure page.
- paulddraper 10y agoBut it isn't meaningless for the assets in a secure page. Those are usually the things you want to cache anyway.
- AgentME 10y agoSubresource integrity isn't supposed to be a replacement for HTTPS. SRI is useful when you're relying on content from another domain, like loading jquery from a CDN that you're not sure is trustworthy. Just because the CDN may support HTTPS doesn't mean that you trust the CDN to give an unbackdoored version of jquery. SRI is used to require that the copy of jquery they give matches a specific hash. HTTPS can still be useful with SRI for privacy. SRI doesn't protect or verify the downloads of html pages generally.