101–110 of 128 posts
Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
(They are both protocols for distributed web apps based on immutable content.)
Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
Do either IPFS or DAT/BeakerBrowser solve this problem? (They are both protocols for distributed web apps based on immutable content.)
I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)
Earlier quoted context omitted.
You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.
They're using key pinning, so you would have to use one of Google's keys and use one of Google's authorized CAs. But second, I imagine the auto-update process is using a non-TLS certificate to verify the signed binaries. Either way you have to hack Google. It would actually be much easier to just find a vuln in Chrome that can break out of sandbox and get root.
Earlier quoted context omitted.
Was it this one? https://github.com/airbornio/signed-web-apps
Nope, it wasn't a library, this was a SaaS website running an open source codebase that was browsable on GitHub.
I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)
Earlier quoted context omitted.
Well one things certain: I'll never use Private Internet Access after this ridiculous comment from you[0] not even three months ago. [0] https://news.ycombinator.com/item?id=17261149 -- need to have "showdead" enabled in profile
I stand by that statement.
EDIT: I'm sure the competition is intense and I'm not sure I would be able to rise above it myself but I think you need to be aware of what it looks like.
I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)
I strongly resent the implied concept that being "East European" by itself could be used as a valid argument to doubt the quality or integrity of a service.
[1] https://www.reddit.com/r/VPNTorrents/comments/90jyoy/heres_w...
[2] https://web.archive.org/web/20180607165926/https://ui.awin.c...
[3] https://web.archive.org/web/20180426151621/http://oxylabs.io...
I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)
This sort of racism is not acceptable.
Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
This (rightfully) comes up every time some browser-based encryption tool is posted. It seems like the desire for such tools isn’t going to go away. Is anyone working on solutions for making distribution of JavaScript applications more secure? There’s a range of assurances you could try to provide, e.x. signatures from the author (or even 3rd parties), prompting for updates, etc. It would likely require support from b…