2 ms·

Wait what? Browsers now offer to load over IPFS? I was wondering how you can trust an IFPS gateway, does does browser verify the file is legit using some chec

by EGreg 3y ago

Wait what? Browsers now offer to load over IPFS? I was wondering how you can trust an IFPS gateway, does does browser verify the file is legit using some checksum? Maybw subresource integrity supports IPFS content hashing or something? How does it generate cid anyway ? https://docs.ipfs.tech/concepts/content-addressing/#cids-are-not-file-hashes https://docs.ipfs.tech/concepts/content-addressing/#cids-are... How would you use SRI here to verify the cid (and not an additional out-of-band hash) make sure the gateway isn’t returning some crap to, say, inject malicious JS?

codetrotter 3y ago
So in my case, I am not using SRI. But I am using the CID as the name in the path. Using the example file from your link, I would host it as something like https://mywebsite.example.com/ipfs/QmPK1s3pNYLi9ERiq3BDxKa4XosgWwFRQUydHUtz4YgpqB https://mywebsite.example.com/ipfs/QmPK1s3pNYLi9ERiq3BDxKa4X... And this was enough for that particular browser I was using to recognize that this file can be attempted to be retrieved directly from IPFS
- EGreg 3y ago
  Yea but the gateway can be compromised, so that is insecure
  - codetrotter 3y ago
    Brave wrote in 2021 that they had plans to verify the CID. Not sure if they have added that or not yet. But either way, I run Brave with a local IPFS gateway on my laptop. So I think when it said that it could retrieve those files via IPFS for me, it meant in my case that those files would be retrieved from actual IPFS and not via a public IPFS gateway hosted on the web