3 ms·
But how do I verify that the JS code being served to me in this moment is the version audited by the trusted party? AFAIK, mainstream browsers have no button to
by limmeau 16y ago
But how do I verify that the JS code being served to me in this moment is the version audited by the trusted party? AFAIK, mainstream browsers have no button to compute a hash over the contents of a website.
(And it's not just reusable JS libraries one would have to audit and checksum; the HTML code of individually rendered message pages could also contain JS code to subvert the security).
- rwolf 16y agoTake a look at Aldo Cortesi's AppHash for one impl of verification of code right when it loads on the page.
- tptacek 16y agoCortesi doesn't have a solution to this problem for unmodified browsers. If you get to modify the browser, you're no longer talking about "web mail"; you might as well just write a real secure mail client, and use HTML5 for your cross-platform UI. I find Cortesi's promotion of his web crypto tools pretty close to the "dishonesty" line. He's not dishonest. But whether he knows it or not, he's coming as close to the line as he can. People keep telling him, browsers can't safely do the things he's telling people they do. He keeps disregarding them.
- baltcode 16y agoYes, but a firefox add-on is easier than a mail client. Cortesi's solution still leaves out the problem of asymmetric encryption, and storing private keys though.