3 ms·
There's also a HTML mechanism that lets you put expected hashes in for script resources etc and the browser is supposed to reject them, but of course because th
by kevingadd 5y ago
There's also a HTML mechanism that lets you put expected hashes in for script resources etc and the browser is supposed to reject them, but of course because this isn't code signing, all the attacker needs to do is compromise the HTML and put in their own sabotaged hashes. Sigh...
- remexre 5y agoYeah, I thought the threat model there was "people sure do love random not-particularly-trustworthy public CDNs"