5 ms·
Yes you can. You just need to download the page and have SRI to serve the javascript. Of course it’s harder to update but now you’re emulating native apps and t
by the_clarence 8y ago
Yes you can. You just need to download the page and have SRI to serve the javascript. Of course it’s harder to update but now you’re emulating native apps and their “added” security
- lvh 8y agoThis is technically true, but the UX for this is so horrendous it's hardly worth taking seriously. If people are willing to put up with bad UX we could instead use TLS client certificates, which are still _much better_ than saving a page that has JS SRI in it (at least it's in the browser!) and has _much better_ cryptographic properties. (And that's assuming that you could somehow get the origin issues right.)
- the_clarence 8y agoThat's the UX of native apps
- orf 8y agoDownload as in wget it? That would break for all kinds of reasons (CORS, CSRF etc), and SRI does nothing if the attacked controls page generation.
- the_clarence 8y agoIf it is made to be downloaded, no
- LukeShu 8y agoNo you can't. The security improvement of PAKE over traditional HTML forms + TLS is that the server never knows the password plaintext; the threat model is a compromised first-party server. If the server is compromised, it can just change the SRI hashes that it sends to the client. SRI is only an effective protection against compromised third-party services.
- lvh 8y agoI can't believe I'm defending save-an-HTML-file-to-disk as a model, but, in their defense: their did say _download_, so you can't mess with the SRI hash. (I don't think this is a good idea, I'm just saying technically your criticism doesn't apply, though you are correct in how SRI works. I'm so sorry :()
- LukeShu 8y agoI mean, tptacek's claim was that "your users will have to install something to make a PAKE secure." If your interpretation of the_clarence's comment is correct, then he didn't refute tptacek's claim, he just suggested a rather silly value of something; something="an HTML file".
- lvh 8y agoSure, his rebuttal wasn’t either :)
- the_clarence 8y agoSri was just an example of how to make it light. Hell you don't need to use sri. Download the whole page and keep using it. But again that's like downloading native apps.