3 ms·

> We urgently need better ways to demonstrate that Element Web hasn’t been tampered with in transit. Serving the content with HTTPS ought to ensure that. What

by shock 5y ago

> We urgently need better ways to demonstrate that Element Web hasn’t been tampered with in transit. Serving the content with HTTPS ought to ensure that. What Cloudflare does with WhatsApp is to prove to facebook the user hasn't modified the code locally. This is dis-empowering the user, not protecting the user.

danShumway 5y ago
> What Cloudflare does with WhatsApp is to prove to facebook the user hasn't modified the code locally. I don't follow. How does this system: A) force users not to ignore the hash mismatch? B) guarantee to Facebook that they haven't ignored the hash mismatch? C) even communicate to Facebook anything about the hash mismatch? This is a clientside comparison, I don't see anything about reporting to Facebook that hashes mismatch. My local Linux installation compares hashes for downloaded packages, I don't see how I as a user having more insight into whether or not the packages is corrupted/altered means I'm disempowered. ---- > Serving the content with HTTPS ought to ensure that That's not what the article is talking about, the article is talking about code being served from a CDN. HTTPS will not protect you from a CDN tampering with your code.
- dane-pgp 5y ago
  I was also a little confused by their comment too, but I assumed they were imagining that the extension would cause the site to fail to load if the user started adding custom scripts into the page somehow. That doesn't mean that any data is sent to Facebook's servers telling them that the user tried to do this, but it would give Facebook confidence that only unmodified web apps are running. Of course, all this presupposes that the user has to install the extension to use WhatsApp on the web, which isn't the case. However, the extension could theoretically be made mandatory if it contained a load of obfuscated code that the web app was dependent on. That would basically mean implementing a type of DRM in the extension, and maybe there is some way to use EME to achieve that at a lower level. If a website ever started using techniques like that, then that would be the point at which to complain about disempowering users. Fortunately this plan doesn't do that, as you say, and merely allows users to optionally confirm that they are running the code they requested.

by shock 5y ago

danShumway 5y ago

> What Cloudflare does with WhatsApp is to prove to facebook the user hasn't modified the code locally. I don't follow. How does this system: A) force users not to ignore the hash mismatch? B) guarantee to Facebook that they haven't ignored the hash mismatch? C) even communicate to Facebook anything about the hash mismatch? This is a clientside comparison, I don't see anything about reporting to Facebook that hashes mismatch. My local Linux installation compares hashes for downloaded packages, I don't see how I as a user having more insight into whether or not the packages is corrupted/altered means I'm disempowered. ---- > Serving the content with HTTPS ought to ensure that That's not what the article is talking about, the article is talking about code being served from a CDN. HTTPS will not protect you from a CDN tampering with your code.

dane-pgp 5y ago
I was also a little confused by their comment too, but I assumed they were imagining that the extension would cause the site to fail to load if the user started adding custom scripts into the page somehow. That doesn't mean that any data is sent to Facebook's servers telling them that the user tried to do this, but it would give Facebook confidence that only unmodified web apps are running. Of course, all this presupposes that the user has to install the extension to use WhatsApp on the web, which isn't the case. However, the extension could theoretically be made mandatory if it contained a load of obfuscated code that the web app was dependent on. That would basically mean implementing a type of DRM in the extension, and maybe there is some way to use EME to achieve that at a lower level. If a website ever started using techniques like that, then that would be the point at which to complain about disempowering users. Fortunately this plan doesn't do that, as you say, and merely allows users to optionally confirm that they are running the code they requested.