Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That is not what subresource integrity is for.

Transport Layer Security guarantees, among other things, that the content really comes from the server it should come from¹. This means that the content was not manipulated by a man-in-the-middle.

However, it does not guarantee that the content was not manipulated by an attacker with access to the server. If a web application (say Gmail) includes a JavaScript library (say jQuery) served by a content delivery network (say code.jquery.com), it can use subresource integrity to have the browser verify that the library was not manipulated by an attacker.

This prevents the threat model where the content delivery network becomes compromised and an attacker replaces the library by malicious code that sends the private data of users to the attacker.

Subresource integrity can also prevent other attacks, but it complements end-to-end encryption. It does not replace it.

¹ This assumes that the certificate is valid, of course. There are problems with the current certificate authority model, but there are also solutions to these problems.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: