3 ms·
Wait, what even is the threat model here? I can't come up with many scenarios in which this makes sense
by nialv7 3y ago
Wait, what even is the threat model here? I can't come up with many scenarios in which this makes sense
- dboreham 3y agoMITM attacks on the root page of an app/site (leaf files can already be validated by subresource integrity checksum). Also if you are interested in a system where software (say, defined as files in a public git repo somewhere) can be both served to a user's browser by an untrusted web server but also trusted by the browser user, you need some e2e validation scheme like this.
- nialv7 3y agoMITM will be stopped by SSL, won't they? For the second use case, isn't that what digital signatures are for?
- schoen 3y agoA different threat model is that you have web applications with some kind of user-controlled encryption (e.g. keys only in local storage, never uploaded to the server) but an adversary tries to substitute a different version of the web application on the server-side that will leak the private keys or decrypt data and then upload it. That adversary could be a government trying to compel the web application developer to serve a compromised version to a particular user or group of users. At least, this is a threat model that I talked about with people who were working on similar tools a few years ago. Edit: for example, you could imagine a messenger application that has end-to-end encryption with a web version of the client. With traditional web applications, the developer could trivially substitute a backdoored version at any time in the future, and users couldn't plausibly detect that.
- nialv7 3y agoWell if the developer is the adversary, then surely they can update the hash on Cloudflare as they upload the backdoor.