4 ms·

Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by b

by Forbo 7y ago

Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by browser developers or as an add-on.

lvh 7y ago
Sure: that’s WebCrypto. The main problem it solves is that you don’t really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of that good crypto, and you still need to do key management. You could do all of this well if WebCrypto was good and you had a WebExtension, or an Electron app, or some other way where you weren’t just going to do whatever the website tells you to do. (That is not a blanket security recommendation in favor of Electron. XSS does not normally get me RCE.)
- Boulth 7y ago
  Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.
  - lvh 7y ago
    Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
    - Forbo 7y ago
      This thread has been very informative and gives me a lot of reading to look into. Thank you so much!
    - Boulth 7y ago
      Too bad there is nothing like that built into browsers directly. I guess not only security related webapps could take advantage of it.