2 ms·
Your comment makes absolute sense if the extension is attempting to validate asset files after they'v been loaded. But the extension can be coded to only load v
by jaekwon 13y ago
Your comment makes absolute sense if the extension is attempting to validate asset files after they'v been loaded. But the extension can be coded to only load vetted code. So I'm not sure what you're talking about. Please enlighten us.
- tptacek 13y agoIf the entire system lives in a browser extension, you're doing what I said in the comment at the top of this thread --- and why would you bother "loading" anything from the server at all? If you know the hash, you know what the file is supposed to be. Otherwise, almost every rendezvous you have with the server is an opportunity for methods to be rebound and your cryptosystem to be subverted. If you don't see how, it's a good exercise to investigate.
- MichaelGG 13y agoHe wouldn't know the hash beforehand, he'd know the keys that are supposed to sign assets. It would work if the plugin can inspect all browser requests attempt and verify every single asset before it's loaded into the browser.