| 12:22 | <lgrahl> | o/ Hey folks! |
| 12:26 | <lgrahl> | Question: There is Subresource Integrity to check integrity of loaded resources. For the use case I have in mind, I also want to ensure integrity of the main resource file (HTML). Thereby, the integrity of the whole "app" can be verified. Is there a way to do this without an extension? Or are there any plans for this? |
| 12:30 | <lgrahl> | Similar to this: https://github.com/tasn/webext-signed-pages |
| 13:38 | <zcorpan> | Hello |
| 13:48 | <Ms2ger> | \o |
| 15:32 | <dtapuska> | annevk: I'm back from vacation and I'd like to close off https://github.com/whatwg/html/pull/4617 I think it was pending your review |
| 15:40 | <annevk> | dtapuska: thanks for the ping, I should have time tomorrow |
| 15:41 | <annevk> | lgrahl: no, no |
| 15:41 | <annevk> | lgrahl: you might wanna review the history around certificate pinning |
| 15:46 | <lgrahl> | annevk: HPKP? Yeah, I know about that one. But this is more about not trusting the server that is delivering the web app. Similar to how I (AFAIK, and at least technically) don't need to trust the Play Store servers as the APK is signed. |
| 15:47 | <annevk> | lgrahl: who is giving you the integrity metadata then? |
| 15:47 | <lgrahl> | Good question. I honestly don't know how it works there. Tofu? |
| 15:47 | <annevk> | oh my |
| 15:48 | <annevk> | Let's not give users the broken default ssh experience |
| 15:48 | <lgrahl> | Maybe there's a better example to dig up... |
| 15:49 | <lgrahl> | (Instead of Play Store) |
| 15:49 | <annevk> | Well, in the end you'll need something you can deploy on the web, so maybe it's best to start there instead of analogies 😃 |
| 15:52 | <lgrahl> | Okay, so the alternative someone else brought up was to install a local webserver (go through all the hassle of doing this for every platform) that runs the backend of the app and the frontend then just connects to that. We can verify that the backend app does match some signature. |
| 15:52 | <lgrahl> | Kind of like Electron but worse I guess |
| 15:57 | <lgrahl> | annevk: And the signature metadata comes from some other central location. Does that improve the security properties? Dunno, perhaps. |
| 16:07 | <lgrahl> | But I get your point. Maybe mobile apps and web apps actually are actually quite similar regarding those security properties and it just "feels" different. |