Web Content Signing with Service Workers — mentioned by littlestymaar

Mon, 26 Jun 2023 11:57:44 GMT

> I suspect they want a browser feature to show fingerprints of the HTML and of subresources possibly to pin a certificate for a given domain. You can do pretty much all you want in a ServiceWorker today[1], but I'll advise against pinning certificates, because you'd just be re-marking HPKP again, with the same gigantic footgun. > A browser setting to only load subresources with integrity checks would also help A “browser setting”? What's the point if the user need to set it up themselves to be secure? Some kind of linting tool on CI in order to be sure you never include a resource without…

Paper and discussion history. A mention is not an endorsement.

Web Content Signing with Service Workers · HackerPapers discussions

Web Content Signing with Service Workers — mentioned by littlestymaar