11 ms·
Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html li
by mattigames 7y ago
Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)
- hagreet 7y agoI think the most important point is, that this solution requires a way to securely transmit the generated link. As described in another comment by @ryandvm this has two advantages over transmitting the password directly: 1. It won't show up in logs or be otherwise accidentally stored. 2. If the link expires after a single use you get security in the covert model. However, this comes with problems because some tools like virus scanners automatically hit links.
- pinehqcom 7y agoExactly exactly. I made sure to be resilient to Google bots/Virus Scanners by doing some fancy javascript tricks
- pinehqcom 7y agoFor this reason I host all the JS/CSS myself and don't have any other JS running. I.e. no google analytics or ad shit.