4 ms·
"If the web client is open-source (as at seems), can't anyone build it locally and compare the built files to what they were served?" Yes, but the results of s
by pmoriarty 5y ago
"If the web client is open-source (as at seems), can't anyone build it locally and compare the built files to what they were served?"
Yes, but the results of such an inspection would only apply to that particular web request at that particular time.
At another time, or to some other person, a different app could be served up by ProtonMail if they so chose.
That's not to mention that the vast majority of ProtonMail users probably don't (and wouldn't have the skills to) evaluate the code they receive from ProtonMail, so even if they were being served up something suspicious, they'd never know.
- mLuby 5y agoSomething like a browser extension could make that kind of check repeatable, automatic, and unobtrusive unless there's a discrepancy. Assuming builds don't happen too too often. Yes, either you'd have to verify the build yourself or trust someone else to do it and independently publish something for the extension to compare to the client it's served.
- dane-pgp 5y agoSomething like a browser extension for this does already exist, fortunately: https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages