31–38 of 38 posts
Earlier quoted context omitted.
Combine SRI with CSPs and cache-control: immutable and you could already commit a page to never change. All that's missing for TOFU is fingerprinting this combination, watching for changes and surfacing the information to the user.
Unfortunately that by itself does not guarantee security. The code that is verified by the bookmarklet could download additional code when it runs, and that code would not be verified.
Earlier quoted context omitted.
Unfortunately that by itself does not guarantee security. The code that is verified by the bookmarklet could download additional code when it runs, and that code would not be verified.
No, preventing that would be the CSP's job.
Earlier quoted context omitted.
No, preventing that would be the CSP's job.
My point is that verifying that the content doesn't change is by itself not enough. You also have to verify that it was secure to begin with, and that is much harder, especially for your typical end-user.
I'm not a crypto expert--so forgive my ignorance.
> this basically boils down to TOFU (trust on first use), but the trust does not perpetuate across uses, so it’s more like, TOAU (trust on any use). The trust is ephemeral, the meeting is ephemeral, the ID is ephemeral. For a lot of meetings, this is perfectly acceptable. I think I would call this TFSU (Trust For Single Use). Trust On Any Use sounds like complete and total trust.
> This is not just a theoretical either: Google Duo supports E2EE group calls on Android, iOS… and web! Google Duo does NOT support E2EE group calls on web... They actually don't support ANY group calls in the web app. Lack of good support for e2ee multiparty calls is probably why - the hope is that adoption of insertable streams will change that.
The equivalent to the app signing cert for a web app is the TLS cert. If security is important to you, don't let third parties control your TLS cert! It's so common now to let CDNs (primarily cloudflare) run your TLS frontend that this article apparently doesn't even consider the idea of hosting an app entirely from servers the app author controls. That said, it's true that a TLS cert is necessarily more exposed than…
The technology you want is Delegated Credentials: https://tools.ietf.org/html/draft-ietf-tls-subcerts-07 The certificate is public, it's fine for copies of that to be in all edge devices, the problem today is that the associated private key has to be on those edge devices too, and that's what Delegated Credentials solves.