HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
tasn
webext-signed-pages
JavaScript2018–2025
tasn / webext-signed-pages

webext-signed-pages

A browser extension to verify the authenticity (PGP signature) of web pages

Web DevelopmentSecurity & Privacy
Explore on GitHubRead Hacker News discussions
8Distinct people
18Mentions
0Explicit recommenders
201GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A browser extension to verify the authenticity (PGP signature) of web pages

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year18 dated mentions

Observed mentions: 2018-01-03 12:45:45 UTC to 2025-04-06 20:06:41 UTC.

012342018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC413
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC303
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC101
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC404
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC303
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

What Hacker News says

18 sources
ranger_danger·Apr 6, 2025
I think one of the growing threats lately in the community has been over malicious client-side javascript, especially when the client handles end-to-end encrypted content (used on sites like Proton, MEGA etc.), so requiring users to trust Google with the contents of these client pages, and by extension the emails themselves, seems (in my opinion) to defeat the entire point of this feature. Some work in this area has been done in the form of browser extensions that are used to verify signed assets delivered to the client: https://github.com/freedomofpress/webcat https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify But unfortunately for now, none of these are seeing wide adoption and this remains an unsolved issue. It also does not require anyone to use known-go
Read the rest
od, audited and verified open-source components, meaning even if the client code is signed, it can still be malicious... there must be a greater reason to trust the code than just "trust me bro".
In Gmail E2E is as terrible as expected
dane-pgp·Apr 19, 2022
> The server can at any time start serving malicious payloads True, and I call this threat model "Beware Each and Every Fetch" (BEEF) in contrast to the more common TOFU model (although if you trust a desktop app to auto-update itself then these two models might not be all that different). In any case, I think you're being a little quick to dismiss the idea of server-hosted applications. It's true that browsers don't natively have a nice way of pinning specific versions of a web app, but there is the clever hack of SecureBookmarks[0] (if you're prepared to sacrifice the UX), or, more realistically, you can pin the web app version using some sort of browser extension. Examples of the latter include the Signed Pages extension[1], and Code Verify[2], which is the result of a collaboration between Meta and Cloudflare (for securing the WhatsA
Read the rest
pp Web code, currently, but should eventually support other sites like Proton's too). Of course, it would be much better if this capability was natively included in browsers themselves, but hopefully adoption of this technology will pressure browsers and standards bodies to take ownership of this. [0] https://coins.github.io/secure-bookmark/ [1] https://github.com/tasn/webext-signed-pages [2] https://github.com/facebookincubator/meta-code-verify
In Security experts declare all Proton apps secure after security audit
dane-pgp·Mar 10, 2022
This is actually fantastic, and I hope it really puts momentum into closing the remaining security gap between JavaScript crypto and the native app equivalent. > The system described in this post doesn’t scale to arbitrary assets – yet – but we are exploring ways in which we could extend this offering for something more general and usable like Binary Transparency. It would be great if other makers of E2EE apps (like ProtonMail and Matrix's Element) joined this initiative and made the verifier work for their web apps too. I'm sure Cloudflare would be happy to partner with those organisations. For context, there have been a few other attempts in the past to verify the contents of web apps, such as Signed Pages[0] and SecureBookmarks[1], but those have had usability drawbacks. One thing I hope Cloudflare end up supporting is returning the
Read the rest
version/hash info from a verifiable append-only log. That way, users can choose to run an old version of a web app until the new version has been around for long enough to be independently reviewed. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
In How Cloudflare verifies the code WhatsApp Web serves to users
dane-pgp·Sep 6, 2021
The browser add-on that comes closest is Signed Page[0], and in theory it could provide TOFU level security by requiring the user to opt in to new versions. For unclear reasons, though, the devs seem to be against implementing that.[1] Any system for protecting against backdoors assumes that someone is auditing the code to check for user-specific code paths, so the only extra layer of security to add is some sort of Binary Transparency. A good example of that is Sigstore, which is being experimentally integrated with the Arch Linux package ecosystem.[2] [0] https://github.com/tasn/webext-signed-pages [1] https://github.com/tasn/webext-signed-pages/issues/13 [2] https://github.com/kpcyrd/pacman-bintrans
In Clarifications regarding arrest of climate activist
dane-pgp·Aug 29, 2021
There are a couple of other ways to mitigate the problem for web applications. If you're willing to install a browser extension, then it might make more sense to use the Signed Pages extension[0] which applies PGP signature checking to web pages. The other solution is to use Secure Bookmarks[1], which combine SRI integrity hashes with Data URIs to ensure that a fixed bundle of JavaScript is running in the page. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
In Show HN: We built an end-to-end encrypted alternative to Google Photos
dane-pgp·Jul 18, 2021
Deploying via IPFS might work indeed, but you're then either reliant on a gateway or have to run IPFS yourself locally. I know that Brave now supports IPFS, but for most people a more lightweight solution would be to install the Signed Pages extension for Chrome or Firefox.[0] I'm not sure if you actually need a trustworthy backend, or rather, if the frontend is encrypting its state before sending it to the backend, then the worst a malicious backend can do is delete or replay your data. By including timestamps and replicating your state to multiple independent backends, that risk can be largely mitigated. [0] https://github.com/tasn/webext-signed-pages
In The new ProtonMail has passed its independent security audit
commoner·Jun 3, 2021
EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
In NortonLifeLock Unveils Norton Crypto
tasn·Jan 10, 2019
Hey everyone, creator here. As it says on the website, EteSync is a secure, end-to-end encrypted and journaled personal information synchronization for Android, the desktop and the web. It currently supports contacts, calendars and task lists, with more on the way. It's been almost two years since I first posted about EteSync here on HN (https://news.ycombinator.com/item?id=13975965) and a lot has changed since. Here are some of the highlights: There are now a web client, a desktop proxy (so you can use e.g. Thunderbird, Outlook or Mac's Contacts app) and a python API, making it available on many more devices. You now can also share your calendars, address books and task lists with other users. So you can e.g. have an end-to-end encrypted shared calendar. We now support sending invitations for calendar events with attendees. Something tha
Read the rest
t's traditionally implemented on the server, but because of end-to-end encryption we had to implement on the client side. There is now support for tasks (todo lists) using the Open Tasks (open source) app. It's already there in the Google Play version, and will be available on F-Droid soon, once they build it. A lot of usability and stability improvements all around thanks to many reports from the community! It's a much more polished product nowadays. The web application is signed and verified in the browser using another project of mine, Signed Pages (https://github.com/tasn/webext-signed-pages/), which adds a layer of in-browser security that's not available elsewhere. I have have a lot more planned, and I just can't wait to get it all out there. :) Looking forward to hearing your feedback, and any cool ideas you may have, or end-to-end encrypted products you're just dying to have but don't exist... Thanks a lot, Tom P.S I'll be giving a talk about some of the challenges with building end-to-end encrypted applications based on my experience from EteSync. You can either attend FOSDEM (free, and a great conference), or watch the live-stream. More information: https://fosdem.org/2019/schedule/event/challenges_in_buildin...
In Show HN: EteSync – Secure, Encrypted, and Journaled Cloud Sync
floatboth·Sep 24, 2018
> if it's encryption in the browser via a web interface, then it's not secure Ehh… The big difference from native apps is that native apps are often signed by the developer. While with web apps, there's normally only a more "temporary" form of signing, that is, the TLS session. Assuming the app developers are better at securing their offline signing keys than TLS server keys, native apps with signatures are indeed more trustworthy. (But are they actually better at this??) However, you can achieve the same kind of signing on the web with a browser extension: https://github.com/tasn/webext-signed-pages (+ SRI and CSP for subresources) Also, you might be more likely to get malware browser extensions than OS-level malware. Maybe?? On the upside, the web is more auditable by default (of course you can obfuscate JS and WASM just like you can ob
Read the rest
fuscate anything, but "view source" is still much easier on the web). > ProtonMail keeps your email encrypted only while it is at rest IIRC it's also end-to-end between ProtonMail addresses or something?
In Ask HN: Best alternative to Gmail?

Showing the 15 most recent of 18 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.