3 ms·
tptacek is right. In order to trust your crypto we have to trust that your server isn't compromising your crypto via malicious JavaScript, so when you claim tha
by rubbingalcohol 12y ago
tptacek is right. In order to trust your crypto we have to trust that your server isn't compromising your crypto via malicious JavaScript, so when you claim that we don't have to trust the server, you're asking us to both trust and not trust the server.
You could do a Chrome extension with all the frontend code baked into the extension's static JavaScript. Firefox still has no sandboxing for add-ons, so you wouldn't have luck there.
Desktop / installed apps would be the way to go. See https://turtl.it https://turtl.it for an example of this (shameless plug)
- nhayden 12y agoI wonder if it'd be possible to sign the JS a site serves you, so you know it's unchanged from when you originally got it?
- nunyabuizness 12y agoYou can sign it, but then your clients would have to install an extension to verify it.
- handsomeransoms 12y agoI think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updating of Service Workers every 24 hours.