webext-signed-pages
web-client
webext-signed-pages | web-client | |
---|---|---|
16 | 137 | |
180 | 432 | |
- | 1.2% | |
0.0 | 4.9 | |
over 1 year ago | 7 days ago | |
JavaScript | JavaScript | |
BSD 3-clause "New" or "Revised" License | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
webext-signed-pages
-
E2EE on the web: is the web that bad?
There is "Signed Pages" by the debeloper of EteSync. It is a browser extension, that checks webapps based on signatures in the html file. The addon then warns the user if the signature is not correct or - if I remember correctly - the source changed. This allows you to be sure what webapp code was delivered. But it seems like it did not really get used outside of his own projects. https://github.com/tasn/webext-signed-pages
-
Cloudflare and CDNs - call for community opinions
EteSync has implemented something called Signed Pages, this might be worth looking closer at. This uses PGP keys which is preloaded into the browser; but I suspect that will be a barrier too high for most non-tech users.
- Is there any tool to verify client-side website code you get served is the same as the open source version?
-
Truly safe?
There are also projects like signed web pages which can also help increasing the trust level to some degree. But that requires that you can download the source code and regenerate the verification hash locally - or have other trusted methods to verify the hash value hasn't been modified as well. The current concept is reasonably sane, but it requires too much from users currently to make it widely used.
- A browser that verifies Javascript
-
Security experts declare all Proton apps secure after security audit
> The server can at any time start serving malicious payloads
True, and I call this threat model "Beware Each and Every Fetch" (BEEF) in contrast to the more common TOFU model (although if you trust a desktop app to auto-update itself then these two models might not be all that different).
In any case, I think you're being a little quick to dismiss the idea of server-hosted applications. It's true that browsers don't natively have a nice way of pinning specific versions of a web app, but there is the clever hack of SecureBookmarks[0] (if you're prepared to sacrifice the UX), or, more realistically, you can pin the web app version using some sort of browser extension.
Examples of the latter include the Signed Pages extension[1], and Code Verify[2], which is the result of a collaboration between Meta and Cloudflare (for securing the WhatsApp Web code, currently, but should eventually support other sites like Proton's too). Of course, it would be much better if this capability was natively included in browsers themselves, but hopefully adoption of this technology will pressure browsers and standards bodies to take ownership of this.
[0] https://coins.github.io/secure-bookmark/
[1] https://github.com/tasn/webext-signed-pages
[2] https://github.com/facebookincubator/meta-code-verify
-
ProtonMail Is Inherently Insecure, Your Emails Are Likely Compromised
Something like a browser extension for this does already exist, fortunately:
https://github.com/tasn/webext-signed-pages
-
"Were you able to subpoena ProtonMail?"
In regards to untrusted webapp, yes, that is a reasonable attack vector. That said, I've heard from ProtonMail they have been considering to implement Signed Pages to help mitigate (at least some of the) issues with this attack vector.
-
Proton’s priorities
Which is why it is important to get proper E2E encryption on e-mail, where the source is open source and can be audited. And then that there are verify mechanisms to verify that the source code has not been manipulated. For web services there are signed-pages which is quite interesting.
web-client
-
Svelte Native: The Svelte Mobile Development Experience
> The only major hurdle to this is Apple continuing to treat web apps as second class citizens on iOS
If you add a site to iOS' homescreen it automatically becomes a PWA. The best example I found of a site fully leveraging this feature is Cryptee[0]. They talk about the PWA thing here: https://crypt.ee/download
[0] https://crypt.ee/
-
Hard for me to trust UpNote
Well, then - if self hosting is not your thing - something like crypt.ee might be your thing? Clearly a different pricing model, data is fully encrypted, open source, across platforms.
-
Where do you write? Why?
https://crypt.ee now. I used to mostly use local markdown editors like Ulysses and Zettlr.
-
Need suggestions for Free, Open-source, privacy focused diary/Journaling app?
Crypt.ee Ticks 1/2/3/5 of your requirements However free tier only has 100MB storage which might be enough for a journal, it also has the best rich text editor of them all, would highly recommend.
-
GitHub: List of open-source alternatives to everyday SaaS products
Crypt.ee for note-taking!
-
Google Drive alternative for editing files on all devices
I've only used it for editing docs but have found crypt.ee very easy to use.
- Photos Zero knowledge encryption
-
Moving my ecosystem from gmail to proton, what to do about Docs,Sheets,Slides,Forms? What services are available?
Cryptee (https://crypt.ee) currently lacks spreadsheet but has a fantastic encrypted word processor/doc suite as well as Photos/Videos
-
What is a good open source and privacy friendly Android E-reader for books?
Cryptee (https://crypt.ee) has native support for epub books and is client-side encrypted so very private
- I hvilken sky gemmer i jeres digitale billeder og videoer?
What are some alternatives?
photos-app - ➡️ Moved to https://github.com/ente-io/ente
Tasmota - Alternative firmware for ESP8266 and ESP32 based devices with easy configuration using webUI, OTA updates, automation using timers or rules, expandability and entirely local control over MQTT, HTTP, Serial or KNX. Full documentation at
mailvelope - Browser extension for OpenPGP encryption with Webmail
Joplin - Joplin - the secure note taking and to-do app with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.
frame - System-wide Web3 for macOS, Windows and Linux
Cryptomator - Multi-platform transparent client-side encryption of your files in the cloud
pacman-bintrans - Experimental binary transparency for pacman with sigstore and rekor
marktext - 📝A simple and elegant markdown editor, available for Linux, macOS and Windows.
leCrypt-web-extension - leCrypt is a decentralised password manager which is cross-platform, free and secure.
privacytools.io - 🛡🛠 You are being watched. Protect your privacy against global mass surveillance.
proton-mail - React web application to manage ProtonMail
CryptPad - Collaborative office suite, end-to-end encrypted and open-source.