3 ms·
> They can't inject anything into the page assuming that someone finds a way to sign a malicious Html page (e.g. by sneaking into the editors office) they can
by buboard 7y ago
> They can't inject anything into the page
assuming that someone finds a way to sign a malicious Html page (e.g. by sneaking into the editors office) they can serve it from anywhere, and the browser will pretend it's coming from the bank
- echeese 7y agoIf someone's able to get the signing key you've already failed at security.