4 ms·

I don't understand why I should have any desire for this.

• dane-pgp 7y ago
  Depending on how it interacts with SRI, there is one interesting use case that could be supported. Imagine you had a data-uri / bookmarklet which loaded a <portal> of a web app, using the ideas discussed here: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456 If the SRI hash on the data-uri could restrict the content of the portal to a trusted HTML document (containing SRI hashes for the scripts it referenced), then navigating "into" the portal would allow the browser to display the URL of the origin site, and run JavaScript in that context, with the TLS indicator visible. This would allow us to pin specific versions of web apps (if they were structured this way), and those apps could be subject to independent audit. Specifically, it would then be impossible for a compromised host to silently "upgrade" you to a new malicious version of the web app (or even downgrade you to an earlier version).