3 ms·
Regarding the malleability of the js runtime, would this be addressed by making all the page content a single html+js file and making its hash widely available
by Joeboy 14y ago
Regarding the malleability of the js runtime, would this be addressed by making all the page content a single html+js file and making its hash widely available for manual verification? Obviously "normal" users aren't going to check it's kosher, but it should mean if a site's serving dodgy code somebody will notice.
Obviously that's a bit impractical for most websites, but it could make sense for a site whose primary raison d'être is encryption.
- zachrose 14y agoInterestingly, this is exactly what the HTTP Content-MD5 header is for.
- martingordon 14y agoI am way out of my league asking this, but couldn't any MITM attack just fake that header as well?
- Joeboy 14y agoYeah, I don't think it actually solves any problems for us. It is, as zachrose says, interesting that it exists though. Also way out of my league, btw :-)