3 ms·
How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
by teraflop 12y ago
How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
- icebraining 12y agoNot OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.
- sarciszewski 12y agoThat's exactly the issue. This is designed to work in conjunction with HTTPS/Tor such that if the server is compromised, unsigned JS payloads cannot compromise the user.
- wahern 12y agoYou could just make it an HTML meta tag which specifies trusted keys. And add an attribute to the script tag which contains the signature. Might need to disable inline JavaScript, though. And double-check that meta tags are only meaningful when located in their proper place in the head tag. I don't like the HTTP header idea, 'cause it precludes static content unless you modify the web server. And I don't like external files which are automatically read by the browser because then you run into namespace problems. Keeping everything in the HTML document provides tidy isolation.
- sarciszewski 12y agoIf you're pulling the public key from the document to use it to verify the document, you've already lost.
- wahern 12y agoYou're using it to verify JavaScript code, not the document. Presuming you also disabled inline JavaScript, you've just shutdown cross-site scripting (XSS) attacks.