tasn/webext-signed-pages
View on GitHub ↗ ★ 201 JavaScript
A browser extension to verify the authenticity (PGP signature) of web pages
18 mentions on Hacker News by 8 people: 1 story, 17 comments · first 2018-01-03 · latest 2025-04-06
20082026
-
…are used to verify signed assets delivered to the client: https://github.com/freedomofpress/webcat https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify But…
comment by ranger_danger · 2025-04-06 · in Gmail E2E is as terrible as expected -
…of web assets (assuming you trust the extension/browser), some via third parties: https://github.com/tasn/webext-signed-pages https://github.com/jahed/webverify https://github.com/facebookincubator/meta-code-verify There was another one pos
comment by ranger_danger · 2025-03-28 · in Web-based cryptography is always snake oil -
…code was delivered. But it seems like it did not really get used outside of his own projects. https://github.com/tasn/webext-signed-pages
comment by breisa · 2024-02-20 · in E2EE on the web: is the web that bad? -
…and standards bodies to take ownership of this. [0] https://coins.github.io/secure-bookmark/ [1] https://github.com/tasn/webext-signed-pages [2] https://github.com/facebookincubator/meta-code-verify
comment by dane-pgp · 2022-04-19 · in Security experts declare all Proton apps secure after security audit -
…a web app until the new version has been around for long enough to be independently reviewed. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
comment by dane-pgp · 2022-03-10 · in How Cloudflare verifies the code WhatsApp Web serves to users -
Something like a browser extension for this does already exist, fortunately: https://github.com/tasn/webext-signed-pages
comment by dane-pgp · 2022-02-15 · in ProtonMail Is Inherently Insecure, Your Emails Are Likely Compromised (2021) -
…is Sigstore, which is being experimentally integrated with the Arch Linux package ecosystem.[2] [0] https://github.com/tasn/webext-signed-pages [1] https://github.com/tasn/webext-signed-pages/issues/13 [2]…
comment by dane-pgp · 2021-09-06 · in Clarifications regarding arrest of climate activist -
…hashes with Data URIs to ensure that a fixed bundle of JavaScript is running in the page. [0] https://github.com/tasn/webext-signed-pages [1] https://coins.github.io/secure-bookmark/
comment by dane-pgp · 2021-08-29 · in Show HN: We built an end-to-end encrypted alternative to Google Photos -
…replicating your state to multiple independent backends, that risk can be largely mitigated. [0] https://github.com/tasn/webext-signed-pages
comment by dane-pgp · 2021-07-18 · in The new ProtonMail has passed its independent security audit -
…the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the…
comment by commoner · 2021-06-03 · in NortonLifeLock Unveils Norton Crypto -
I haven't seen any mentions or this extension that allows verifying pages before they are rendered: https://github.com/tasn/webext-signed-pages Another thing is non exportable WebCrypto keys that can limit the damage even if the page is…
comment by Boulth · 2020-06-05 · in So You Want to Build an End-to-End Encrypted Web App -
…though because Chrome extensions don't have access to the content of the HTTP responses [2]. [1] https://github.com/tasn/webext-signed-pages [2] https://bugs.chromium.org/p/chromium/issues/detail?id=487422
comment by _rlx_ · 2019-05-22 · in End-to-End Encryption SDK for JavaScript -
Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches…
comment by Boulth · 2019-04-25 · in ProtonMail now offers elliptic curve cryptography -
…web application is signed and verified in the browser using another project of mine, Signed Pages ( https://github.com/tasn/webext-signed-pages/ ), which adds a layer of in-browser security that's not available elsewhere. I have have a lot…
comment by tasn · 2019-01-10 · in Show HN: EteSync – Secure, Encrypted, and Journaled Cloud Sync -
…at this??) However, you can achieve the same kind of signing on the web with a browser extension: https://github.com/tasn/webext-signed-pages (+ SRI and CSP for subresources) Also, you might be more likely to get malware browser extensions…
comment by floatboth · 2018-09-24 · in Ask HN: Best alternative to Gmail? -
Shameless plug: I created a browser extension to solve just that: https://github.com/tasn/webext-signed-pages/ It lets devs PGP sign their web apps and verifies those signatures. We use it for the EteSync ( https://www.EteSync.com ) web…
comment by tasn · 2018-03-01 · in Show HN: Graphite – A decentralized and encrypted Google Docs alternative -
…Just to give a counter to your "is that JS-land can never be treated seriously" statement. Link: https://github.com/tasn/webext-signed-pages/ It's used by EteSync to secure its web client.
comment by tasn · 2018-01-14 · in The Tangled Web: A Guide to Securing Modern Web Applications (2011)