5 ms·

If you're going to rely on any client-side javascript please use subresource integrity for all your assets.

• speedgoose 6y ago
  If TLS is compromised, you cannot trust the subresource subresource integrity checksums. It's better than nothing but there is no good solution.
  • blueplanet200 6y ago
    Indeed, if TLS is compromised many security guarantees of the web break down.
  • bawolff 6y ago
    Which is why this whole exercise is a bunch of snake oil. You can't have better than TLS security when TLS is the weakest link.
    • blueplanet200 6y ago
      This is just plain false. This search engine is advertising anonymity. You don't get that when searching Google, which is encrypted with TLS...
  • rasengan 6y ago
    Our solution here is our extensions [1][2] which are hosted and served by google and mozilla (third parties). [1] https://chrome.google.com/webstore/detail/privatesh-private-search/fcehiiknopcbcdnpakbeipijiiceobnl https://chrome.google.com/webstore/detail/privatesh-private-... [2] https://addons.mozilla.org/en-US/firefox/addon/private-sh-private-search/ https://addons.mozilla.org/en-US/firefox/addon/private-sh-pr...