3 ms·
In theory it's possible, sure. But in practice webapps are not set up for reproducible, auditable, signed builds with zero dynamic execution of 3rd-party code a
by the8472 7y ago
In theory it's possible, sure. But in practice webapps are not set up for reproducible, auditable, signed builds with zero dynamic execution of 3rd-party code and making those signatures available in a standarized format. Plus browsers lack the tools to make this kind of fingerprinting effortless to verify for the user.
- jakelazaroff 7y agoSure, but how often do users do this in practice for any apps? I know I don't check the fingerprints for Signal or WhatsApp or iMessage on my phone. And even if the actual binary I'm running is secure, plenty of apps that claim to provide E2E encryption don't give me any way to verify the key of the other user. How do I know that iMessage or Facebook Messenger aren't inserting their own key pairs me and the people I'm messaging?