3 ms·
HTTPS guarantee the source, not that meta is sending you the same code as everyone else. With this, an adversary at meta must compromise Meta and Cloudflare.
by mcosta 3y ago
HTTPS guarantee the source, not that meta is sending you the same code as everyone else. With this, an adversary at meta must compromise Meta and Cloudflare.
- ametrau 3y agoI think you would still have big problems if you had an adversary at meta. Bigger than this.
- cookiengineer 3y agoBy that logic the extension from the very same vendor is automatically compromised, too. If a website is compromised, no extension will fix this. Only a rollback to a specific known-to-be-legit hash in IPFS. And meta won't embrace IPFS, ever.
- dboreham 3y agoThe idea is you install the extension ahead of time when you do trust the source.
- cookiengineer 3y agoWhat is the difference to resource integrity and certificate pinning which is already implemented among every single Browser via the HSTS policies? Also, do you really think meta's products will have static assets for eternity from the point of installing an extension? Absurdly unlikely.