4 ms·

Couldn't the client verify the integrity of the code against a published hash?

• mkup 15y ago
  yes, but hash comparison operator will be executed on client side only if it wasn't stripped away along the path
  • macmac 15y ago
    I was thinking of a manual check, which would be a hassle, but would only have to be done when the script was changed.
  • dagw 15y ago
    I suppose it could be combined with some sort of grease monkey type component, where the user supplies their own hash operator code.
    • sneak 15y ago
      At that point, why bother implementing crypto in JavaScript anyway? You might as well just use a proper clientside app (a halfassed version of which is your suggestion).
• tptacek 15y ago
  No! Very common misconception! You cannot verify the integrity of a browser Javascript cryptosystem by checking a SHA2 hash of the Javascript file containing the crypto. That's because any other piece of content, from Ajax requests and whatnot to, in many browsers, the CSS files, some of them cached and some of them loaded on the spot... any other piece of content that contributed to the page that hosts the crypto code can alter the runtime to trivially intercept secrets or fix keys. Until browsers provide a primitive to verify the whole runtime, cryptographic hashes won't do anything to ensure integrity for Javascript.