5 ms·

Encrypted page includes javascript from 2 CDNs, one for jQuery and one for "crypto-js". The jQuery one has an integrity hash, but "crypto-js" does not. Granted,

Encrypted page includes javascript from 2 CDNs, one for jQuery and one for "crypto-js". The jQuery one has an integrity hash, but "crypto-js" does not. Granted, they both use HTTPS... Doesn't seem very secure to include external JS on an encrypted page. Why not include those things inline? And why does it need jQuery for a simple 1-input form field that decrypts a string?!

acdha 9y ago
Using a CDN is only a problem if it's compromised, which is unlikely to be a threat for most applications. You can avoid this entirely by using Subresource Integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... It looks like the developer for this page copied the CDNJS links at some point but didn't do so consistently and later commented out the SRI portion of the jQuery tag: 
- yoble 9y ago
  Oops thanks, that should be fixed - the generating page now gets its libraries from CDNs. I'll probably look into adding Subressource Integrity checks for the other two as well.
- joshu 9y ago
  It is also a threat if your DNS is compromised.
  - a3_nm 9y ago
    Not when fetching over HTTPS.
    - snakeanus 9y ago
      The CA system is extremely broken, it won't protect you from a state actor. Also TLS + DANE is useless if the DNS is compromised.
      - acdha 9y ago
        That's a bit too much hyperbole to be useful: yes, a state which runs a trusted CA is a threat (at least for sites which don't use key-pinning) but there are a ton of other things you're at risk for that way like SMS-based auth and the police or black bag squad paying you a visit. Describing the CA model as extremely broken because it doesn't handle an out-of-scope threat doesn't help anyone change their behavior to avoid it.
pc86 9y ago
Stack Overflow is riddled with questions from people asking how to do incredibly basic things "in jQuery."
- wlesieutre 9y ago
  I think this one is satire, but you never know ;) http://i.imgur.com/Q3mkcnl.gif http://i.imgur.com/Q3mkcnl.gif
  - egeozcan 9y ago
    I especially like the creativity in the "related questions".
    - Cyphase 9y ago
      "How can I use JavaScript to parse some HTML using regex?" Priceless.
    - johnsonjo 9y ago
      There's one that says "Where are my legs?" Took me a second to get but I think it's a reference to head and body in HTML.
  - steveadoo 9y ago
    That is definitely satire.
  - Already__Taken 9y ago
    Werry_Togan is an excellent username haha. There's a lot of subtlety to this. https://en.wikipedia.org/wiki/Terry_Wogan https://en.wikipedia.org/wiki/Terry_Wogan
- enobrev 9y ago
  My highest rated answer on Stack overflow, by an enormous margin, is a simple jquery question (How to get the value of a textarea).
johnhenry 9y ago
I don't mean this to sound sarcastic, but you seem to be knowledgable enough to make a pull request to the open source project? [Edit: looks like this may already be on the way to addressing your issue https://github.com/robinmoisson/staticrypt/issues/1 https://github.com/robinmoisson/staticrypt/issues/1]
- onion2k 9y ago
  Embedding the crypt.js library in the resulting page would essentially pin the page to the version that was current at the time the HTML was encrypted. That could be problematic if there's a bug in the library.
  - TeMPOraL 9y ago
    OTOH it makes the HTML file require an Internet connection to view.
yoble 9y ago
I like the idea of the page relying as little as possible on my code (you have a better chance to trust a well known public CDN on HTTPS than some minified code inlined from an unknow github repo). But I understand your point, plus it would be nice to have a page working completely offline. Will add the option to embed the needed library in the single file. It definitely does not need jQuery :) The page was a POC, since it seems it might be useful to some I'll clean it up. Thanks for the feedback !
sodafountan 9y ago
While it's true that jQuery is unnecessary, why does it matter? For one this is just a simple example to show off something cool that's possible that many people wouldn't initially think would be, I highly doubt that this is meant to be used seriously but more importantly it re-writes the entire page once the passphrase is found which overrides the jquery dependency and all other dependencies. Why do people like to complain so much?
- Gaelan 9y ago
  jQuery stays in the JS namespace even after its <script> is gone.
  - sodafountan 9y ago
    You're right, I looked back and it does in fact stay in the namespace. Disregard my comment.

acdha 9y ago

Using a CDN is only a problem if it's compromised, which is unlikely to be a threat for most applications. You can avoid this entirely by using Subresource Integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... It looks like the developer for this page copied the CDNJS links at some point but didn't do so consistently and later commented out the SRI portion of the jQuery tag:

yoble 9y ago
Oops thanks, that should be fixed - the generating page now gets its libraries from CDNs. I'll probably look into adding Subressource Integrity checks for the other two as well.
joshu 9y ago
It is also a threat if your DNS is compromised.
- a3_nm 9y ago
  Not when fetching over HTTPS.
  - snakeanus 9y ago
    The CA system is extremely broken, it won't protect you from a state actor. Also TLS + DANE is useless if the DNS is compromised.
    - acdha 9y ago
      That's a bit too much hyperbole to be useful: yes, a state which runs a trusted CA is a threat (at least for sites which don't use key-pinning) but there are a ton of other things you're at risk for that way like SMS-based auth and the police or black bag squad paying you a visit. Describing the CA model as extremely broken because it doesn't handle an out-of-scope threat doesn't help anyone change their behavior to avoid it.

pc86 9y ago

Stack Overflow is riddled with questions from people asking how to do incredibly basic things "in jQuery."

wlesieutre 9y ago
I think this one is satire, but you never know ;) http://i.imgur.com/Q3mkcnl.gif http://i.imgur.com/Q3mkcnl.gif
- egeozcan 9y ago
  I especially like the creativity in the "related questions".
  - Cyphase 9y ago
    "How can I use JavaScript to parse some HTML using regex?" Priceless.
  - johnsonjo 9y ago
    There's one that says "Where are my legs?" Took me a second to get but I think it's a reference to head and body in HTML.
- steveadoo 9y ago
  That is definitely satire.
- Already__Taken 9y ago
  Werry_Togan is an excellent username haha. There's a lot of subtlety to this. https://en.wikipedia.org/wiki/Terry_Wogan https://en.wikipedia.org/wiki/Terry_Wogan
enobrev 9y ago
My highest rated answer on Stack overflow, by an enormous margin, is a simple jquery question (How to get the value of a textarea).

johnhenry 9y ago

I don't mean this to sound sarcastic, but you seem to be knowledgable enough to make a pull request to the open source project? [Edit: looks like this may already be on the way to addressing your issue https://github.com/robinmoisson/staticrypt/issues/1 https://github.com/robinmoisson/staticrypt/issues/1]

onion2k 9y ago
Embedding the crypt.js library in the resulting page would essentially pin the page to the version that was current at the time the HTML was encrypted. That could be problematic if there's a bug in the library.
- TeMPOraL 9y ago
  OTOH it makes the HTML file require an Internet connection to view.

yoble 9y ago

I like the idea of the page relying as little as possible on my code (you have a better chance to trust a well known public CDN on HTTPS than some minified code inlined from an unknow github repo). But I understand your point, plus it would be nice to have a page working completely offline. Will add the option to embed the needed library in the single file. It definitely does not need jQuery :) The page was a POC, since it seems it might be useful to some I'll clean it up. Thanks for the feedback !

sodafountan 9y ago

While it's true that jQuery is unnecessary, why does it matter? For one this is just a simple example to show off something cool that's possible that many people wouldn't initially think would be, I highly doubt that this is meant to be used seriously but more importantly it re-writes the entire page once the passphrase is found which overrides the jquery dependency and all other dependencies. Why do people like to complain so much?

Gaelan 9y ago
jQuery stays in the JS namespace even after its <script> is gone.
- sodafountan 9y ago
  You're right, I looked back and it does in fact stay in the namespace. Disregard my comment.