Hacker GitHub

← All repos

tasn/webext-signed-pages

View on GitHub ↗ ★ 201 JavaScript

A browser extension to verify the authenticity (PGP signature) of web pages

18 mentions on Hacker News by 8 people: 1 story, 17 comments · first 2018-01-03 · latest 2025-04-06

Mentions per year 18 mentions · busiest year 2018 (4)
20082026
AllStoriesComments NewestTopOldest
  1. …are used to verify signed assets delivered to the client: https://github.com/freedomofpress/webcat https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify But…
    comment by ranger_danger · 2025-04-06 · in Gmail E2E is as terrible as expected
  2. …of web assets (assuming you trust the extension/browser), some via third parties: https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify There was another one pos
    comment by ranger_danger · 2025-03-28 · in Web-based cryptography is always snake oil
  3. …code was delivered. But it seems like it did not really get used outside of his own projects. https://github.com/tasn/webext-signed-pages
    comment by breisa · 2024-02-20 · in E2EE on the web: is the web that bad?
  4. …and standards bodies to take ownership of this. [0] https://coins.github.io/secure-bookmark/ [1] https://github.com/tasn/webext-signed-pages [2] https://github.com/facebookincubator/meta-code-verify
    comment by dane-pgp · 2022-04-19 · in Security experts declare all Proton apps secure after security audit
  5. …a web app until the new version has been around for long enough to be independently reviewed. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
    comment by dane-pgp · 2022-03-10 · in How Cloudflare verifies the code WhatsApp Web serves to users
  6. Something like a browser extension for this does already exist, fortunately: https://github.com/tasn/webext-signed-pages
    comment by dane-pgp · 2022-02-15 · in ProtonMail Is Inherently Insecure, Your Emails Are Likely Compromised (2021)
  7. …is Sigstore, which is being experimentally integrated with the Arch Linux package ecosystem.[2] [0] https://github.com/tasn/webext-signed-pages [1] https://github.com/tasn/webext-signed-pages/issues/13 [2]…
    comment by dane-pgp · 2021-09-06 · in Clarifications regarding arrest of climate activist
  8. …hashes with Data URIs to ensure that a fixed bundle of JavaScript is running in the page. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
    comment by dane-pgp · 2021-08-29 · in Show HN: We built an end-to-end encrypted alternative to Google Photos
  9. …replicating your state to multiple independent backends, that risk can be largely mitigated. [0] https://github.com/tasn/webext-signed-pages
    comment by dane-pgp · 2021-07-18 · in The new ProtonMail has passed its independent security audit
  10. …the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the…
    comment by commoner · 2021-06-03 · in NortonLifeLock Unveils Norton Crypto
  11. I haven't seen any mentions or this extension that allows verifying pages before they are rendered: https://github.com/tasn/webext-signed-pages Another thing is non exportable WebCrypto keys that can limit the damage even if the page is…
    comment by Boulth · 2020-06-05 · in So You Want to Build an End-to-End Encrypted Web App
  12. …though because Chrome extensions don't have access to the content of the HTTP responses [2]. [1] https://github.com/tasn/webext-signed-pages [2] https://bugs.chromium.org/p/chromium/issues/detail?id=487422
    comment by _rlx_ · 2019-05-22 · in End-to-End Encryption SDK for JavaScript
  13. Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches…
    comment by Boulth · 2019-04-25 · in ProtonMail now offers elliptic curve cryptography
  14. …web application is signed and verified in the browser using another project of mine, Signed Pages ( https://github.com/tasn/webext-signed-pages/ ), which adds a layer of in-browser security that's not available elsewhere. I have have a lot…
    comment by tasn · 2019-01-10 · in Show HN: EteSync – Secure, Encrypted, and Journaled Cloud Sync
  15. …at this??) However, you can achieve the same kind of signing on the web with a browser extension: https://github.com/tasn/webext-signed-pages (+ SRI and CSP for subresources) Also, you might be more likely to get malware browser extensions…
    comment by floatboth · 2018-09-24 · in Ask HN: Best alternative to Gmail?
  16. Shameless plug: I created a browser extension to solve just that: https://github.com/tasn/webext-signed-pages/ It lets devs PGP sign their web apps and verifies those signatures. We use it for the EteSync ( https://www.EteSync.com ) web…
    comment by tasn · 2018-03-01 · in Show HN: Graphite – A decentralized and encrypted Google Docs alternative
  17. …Just to give a counter to your "is that JS-land can never be treated seriously" statement. Link: https://github.com/tasn/webext-signed-pages/ It's used by EteSync to secure its web client.
    comment by tasn · 2018-01-14 · in The Tangled Web: A Guide to Securing Modern Web Applications (2011)
  18. ▲ 3
    Show HN: A browser extension to verify the authenticity (PGP) of web pages
    story by tasn · 2018-01-03 · 0 comments