4 ms·
How does this prevent an attacker on the server from changing the page? (How is trust verified?) Also, this doesn't seem suited to dynamic applications.
by jimktrains2 9y ago
How does this prevent an attacker on the server from changing the page? (How is trust verified?) Also, this doesn't seem suited to dynamic applications.
- drdaeman 9y agoNot an author, but each user has to manually provide an URL pattern and public key, which are meant to be verified out of band. If you don't - visiting the signed pages won't do anything. The extension would just say "no signature expected" and won't even show there is something (i.e. no "noticed an unknown untrusted signature" statuses).