5 ms·
Yes it is. Hashes must absolutely be used in that case.
by valenterry 2y ago
Yes it is. Hashes must absolutely be used in that case.
- LtWorf 2y agoIt should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.
- valenterry 2y agoMaybe, but just from a security point of view it's totally fine.
- LtWorf 2y agoGetting tracked is less secure than not getting tracked.
- SideQuark 2y agoGetting hacked is less secure than getting tracked.
- LtWorf 2y agoVery clever. But getting tracked doesn't in any way protect you from getting hacked. It just exposes you to more risks, including getting hacked.
- valenterry 2y agoFair enough.
- Thorrez 2y agoAre you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1]. Disclosure: I work at Google, but not on Chrome. [1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/ https://flbrack.com/posts/2023-02-15-dont-break-the-web/
- LtWorf 2y agoAlso expired certificates break a lot of websites… should we disable checking?
- ameliaquining 2y agoCertificate expiration isn't an unanticipated regression. You know when you get a certificate when it will expire.
- hyperdimension 2y agoI don't mean to be pedantic, but not always--see the recent DigiCert delayed revocation issues. I will admit it is rare though and more often than not, you (should) know when your certs are going to expire.
- Thorrez 2y agoThose websites set up the expiring certificate themselves.