3 ms·
No more than NoScript forks the web.
by sarciszewski 12y ago
No more than NoScript forks the web.
- eli 12y agoSo if I hack a website what's stopping me from serving javascript with no signature or my own signature?
- sarciszewski 12y agoAh, key management, the bane of any asymmetric crypto system! My draft specified TOFU; if a site was previously signed and no signature is attached, don't allow any JS. If the signature doesn't match the key cached in the browser, go full noscript.
- eli 12y agoWouldn't I typically want my Tor Browser to not record any details about sites I have previously visited? Seems like a lot of work for modestly more security.
- sarciszewski 12y agoDisclaimer: This was an idea that nobody ever showed interest in and therefore I never put forth the effort to refine and flesh out. Feel free to take it and run with it if you have better ideas.
- onedognight 12y agoThis was solved for the case of http/https with the "Strict-Transport-Security" header which says that all future communication (for a certain time) will always be over HTTPS. The browser could easily respond to similar "Strict-Signature-Security" header requiring all files to come with a Signature header in the future.