meta-code-verify

I think one of the growing threats lately in the community has been over malicious client-side javascript, especially when the client handles end-to-end encrypted content (used on sites like Proton, MEGA etc.), so requiring users to trust Google with the contents of these client pages, and by extension the emails themselves, seems (in my opinion) to defeat the entire point of this feature. Some work in this area has been done in the form of browser extensions that are used to verify signed assets delivered to the client: https://github.com/freedomofpress/webcat https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify But unfortunately for now, none of these are seeing wide adoption and this remains an unsolved issue. It also does not require anyone to use known-go

There are some efforts to use extensions to allow signing/verification of web assets (assuming you trust the extension/browser), some via third parties: https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify There was another one posted here recently, but I'm unable to find it now.

(2022) https://github.com/facebookincubator/meta-code-verify is the goods, and is MIT https://github.com/facebookincubator/meta-code-verify#instal... says Safari support is "coming soon" (from 2022) so I guess they think those users don't need to "verify[..] the integrity of a web page."

> What would prevent Twitter from sending a specific party a special version of their JS that sends an obfuscated unencrypted copy of your messages to the mothership? I'm glad you asked. This is exactly the same problem that WhatsApp have been trying to solve for their web app, and they came up a browser extension called meta-code-verify[0] which checks the hash of the code received against an external append-only log. The extension only supports the WhatsApp site so far, but should be flexible enough to support others that opt into it. Of course ideally this approach would become popular enough that the technology would be integrated into the browser itself, so that users wouldn't need to install the extension at all. I also hope that ProtonMail push for this too, since they are subject to the same threat model and care about open sour

> The server can at any time start serving malicious payloads True, and I call this threat model "Beware Each and Every Fetch" (BEEF) in contrast to the more common TOFU model (although if you trust a desktop app to auto-update itself then these two models might not be all that different). In any case, I think you're being a little quick to dismiss the idea of server-hosted applications. It's true that browsers don't natively have a nice way of pinning specific versions of a web app, but there is the clever hack of SecureBookmarks[0] (if you're prepared to sacrifice the UX), or, more realistically, you can pin the web app version using some sort of browser extension. Examples of the latter include the Signed Pages extension[1], and Code Verify[2], which is the result of a collaboration between Meta and Cloudflare (for securing the WhatsA