Earlier quoted context omitted.
The idea of using a service worker to install a persistent loader is a good one, and it was used by the WebSign system: https://www.reddit.com/r/crypto/comments/42kzx1/thoughts_on_... Unfortunately it relied on the HPKP Suicide technique, since otherwise a compromised server could send a malicious update to the service worker code. Now that HPKP has been abandoned by browsers, WebSign is no longer viable (and it alwa…
Actually WebSign is still in production at Cyph, and never strictly depended on HPKP, with the caveats that: 1. Rather than simply prevent an attack, it shows a scary warning that compromised code will be run on the next reload, and 2. It relies on things that aren't intended as security features, and so is inherently more fragile than it was originally. In particular, if an attacker could fill up enough of a user's…
Re: Proof of concept: end-to-end encryption in Jitsi Meet
#151This is exactly what I mean. It's a missing primitive.