Hacker News new | ask | show | jobs
by jhardy54 2206 days ago
Today: Maybe subresource integrity? That would let you advertise the exact state of the webpage, but you'd need to save it somewhere for verification.

Alternative: Isn't there some way to save an HTTPS request in a way that others can verify that the webpage was signed with an authorized certificate?

Future: I wish authors would sign their content directly rather than depend on TLS and certificate authorities. P2P networks do this well (because they have to) but it hasn't caught on in the rest of the web.

2 comments

> Isn't there some way to save an HTTPS request in a way that others can verify that the webpage was signed with an authorized certificate?

That sounds a lot like "Signed HTTP Exchanges"[0], which has some support in Chrome but doesn't automatically provide a way of checking quotes in web pages.

[0] https://wicg.github.io/webpackage/draft-yasskin-http-origin-...

There was TLS-N[0][1], which did something like this and emerged for blockchain use cases and worked with only minor tweaks for the website provider IIRC. Sadly that looks pretty much defunct now.

[0]: https://eprint.iacr.org/2017/578.pdf

[1]: https://github.com/tls-n