Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting sites from Cryptojacking with CSP and SRI

scotthelme.co.uk

Post reply on HN
Print view View original

11–20 of 85 posts

Re: Protecting sites from Cryptojacking with CSP and SRI

#11

Post by greglindahl »

walterbell wrote: post #3

What percentage of mainstream sites use the "integrity" hash validation attribute when loading 3rd-party script for a known-good library version? Would be a useful data point for a "tech stack" web crawler to monitor.

Use of integrity hash validation is pretty limited -- I see 90k sites in the top 10 million.

It's a shame this isn't more popular, I'd love to build a browser add-on that uses the integrity hash as the name of the script, and load them from ipfs or something.

Top sites: gov.uk, nhm.ac.uk, change.org, blogs.worldbank.org, handbrake.fr, army.mil, genome.gov, ...

Re: Protecting sites from Cryptojacking with CSP and SRI

#13

Post by petagonoral »

> What I've done here is add the SRI Integrity Attribute and that allows the browser to determine if the file has been modified, which allows it to reject the file

Wouldn't this negate one of the benefits of a 3rd party hosted SaaS? Otherwise, you have to redeploy everytime your provider updates their lib?

Re: Protecting sites from Cryptojacking with CSP and SRI

#16

Post by teej »

petagonoral wrote: post #13

> What I've done here is add the SRI Integrity Attribute and that allows the browser to determine if the file has been modified, which allows it to reject the file Wouldn't this negate one of the benefits of a 3rd party hosted SaaS? Otherwise, you have to redeploy everytime your provider updates their lib?

It’s not uncommon to freeze 3rd party libs. Do you want a 3rd party provider to have access to hot deploy to your website?

Re: Protecting sites from Cryptojacking with CSP and SRI

#17

Post by userbinator »

jnordwick wrote: post #12

When will the JavaScript community learn to stop trusting 3rd party code downloaded over the internet? In the previous event the code disappeared. This time it isn't what you wanted.

When will the JavaScript community learn to stop trusting 3rd party code downloaded over the internet?

Given that the majority in the JS community probably have it enabled by default in their browsers, probably never...

Re: Protecting sites from Cryptojacking with CSP and SRI

#19

Post by [deleted] »

userbinator wrote: post #8

Presumably, the "[Warning] Do not copy or self host this file, you will not be supported" is because they change the script reasonably often, meaning that using SRI will require them to change their hashes on every linked page every time the script changes or it will stop working --- probably not what they want. when visiting the ICO website That is... amusingly ironic.

[deleted]
Post reply on HN