Hacker News Reader

Comment by fredsted | Hacker News Reader

Encrypted page includes javascript from 2 CDNs, one for jQuery and one for "crypto-js". The jQuery one has an integrity hash, but "crypto-js" does not. Granted, they both use HTTPS...

Doesn't seem very secure to include external JS on an encrypted page.

Why not include those things inline?

And why does it need jQuery for a simple 1-input form field that decrypts a string?!

View on HN

Using a CDN is only a problem if it's compromised, which is unlikely to be a threat for most applications. You can avoid this entirely by using Subresource Integrity:

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

It looks like the developer for this page copied the CDNJS links at some point but didn't do so consistently and later commented out the SRI portion of the jQuery tag:

    <!--integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="-->

Oops thanks, that should be fixed - the generating page now gets its libraries from CDNs.

I'll probably look into adding Subressource Integrity checks for the other two as well.

It is also a threat if your DNS is compromised.

Not when fetching over HTTPS.

The CA system is extremely broken, it won't protect you from a state actor. Also TLS + DANE is useless if the DNS is compromised.

That's a bit too much hyperbole to be useful: yes, a state which runs a trusted CA is a threat (at least for sites which don't use key-pinning) but there are a ton of other things you're at risk for that way like SMS-based auth and the police or black bag squad paying you a visit. Describing the CA model as extremely broken because it doesn't handle an out-of-scope threat doesn't help anyone change their behavior to avoid it.

Stack Overflow is riddled with questions from people asking how to do incredibly basic things "in jQuery."

I think this one is satire, but you never know ;) http://i.imgur.com/Q3mkcnl.gif

I especially like the creativity in the "related questions".

"How can I use JavaScript to parse some HTML using regex?"

Priceless.

There's one that says "Where are my legs?" Took me a second to get but I think it's a reference to head and body in HTML.

That is definitely satire.

Werry_Togan is an excellent username haha. There's a lot of subtlety to this.

https://en.wikipedia.org/wiki/Terry_Wogan

My highest rated answer on Stack overflow, by an enormous margin, is a simple jquery question (How to get the value of a textarea).

Is the answer "you don't need jQuery for this"? :)

I like the idea of the page relying as little as possible on my code (you have a better chance to trust a well known public CDN on HTTPS than some minified code inlined from an unknow github repo).

But I understand your point, plus it would be nice to have a page working completely offline. Will add the option to embed the needed library in the single file.

It definitely does not need jQuery :) The page was a POC, since it seems it might be useful to some I'll clean it up. Thanks for the feedback !

I don't mean this to sound sarcastic, but you seem to be knowledgable enough to make a pull request to the open source project?

[Edit: looks like this may already be on the way to addressing your issue https://github.com/robinmoisson/staticrypt/issues/1]

Embedding the crypt.js library in the resulting page would essentially pin the page to the version that was current at the time the HTML was encrypted. That could be problematic if there's a bug in the library.

OTOH it makes the HTML file require an Internet connection to view.

While it's true that jQuery is unnecessary, why does it matter? For one this is just a simple example to show off something cool that's possible that many people wouldn't initially think would be, I highly doubt that this is meant to be used seriously but more importantly it re-writes the entire page once the passphrase is found which overrides the jquery dependency and all other dependencies.