3 ms·
In theory you can generate the code locally and compare it with the deployed version to see that it's one to one.. But maybe we could do something in order to i
by lipis 7y ago
In theory you can generate the code locally and compare it with the deployed version to see that it's one to one.. But maybe we could do something in order to improve the said security check.
- deleted 7y ago[deleted]
- sneak 7y agoNot even in theory: the version you download to "check" and the version served to your web browser may not be the same content, as the webserver can respond with different content for the same URL, on a per request basis, for example serving the exploit code only to a specific ip + user-agent header combination, so that it steals your keys in your browser but shows the safe version to `curl`.