Hacker News new | ask | show | jobs
by rcxdude 2285 days ago
Yes, but there's no provision in the browser to do these kinds of integrity checks. If the browser isn't verifying it there's no point in adding any of this info, because it can be substituted covertly. In principle such 'version-pinning' could be added to the browser, but no-one has done so yet.
1 comments

Agreed. Even subresource integrity [1] does not help here, because if the HTML is compromised, then everything else can be too.

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...