4 ms·

Not contradicting you in any way, but you can check out the javascript. Javascript deobfuscation is pretty sophisticated nowadays (maybe not) from my naive perc

• dane-pgp 5y ago
  I think the complaint is that it takes a lot of work to check, each time you visit the site, that the JavaScript your browser downloads is really the same as the published (and assumed secure) source code (plus obfuscation, as you mention). Ideally there would be a mechanism in browsers to pin a specific version of a web app, and only let that app update (to a version with a specific hash) if the user explicitly gives it permission to. The nearest thing we have to that right now is the SRI-bookmarklet trick: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
  • commoner 5y ago
    EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...