Hacker News Reader

Comment by dane-pgp | Hacker News Reader

One security aspect that I guess is out of scope for the audit is dealing with the threat model of a compromised server, which can insert a backdoor into the JavaScript code it delivers to the user.

A possible mitigation for this would be to support loading the site as a Secure Bookmark.[0] There might be technical and UX issues with doing this, but it would be interesting to know if it was at least possible to make it available as an option.

[0] https://coins.github.io/secure-bookmark/

View on HN

Deploying via IPFS might also work? Though it'd require having a trustworthy backend storing state ... or I suppose auditing to ensure backend can't inject anything malicious into client layer.

From what I understand, some cryptocurrency DApps like Uniswap[0] are using this route.

[0] https://github.com/Uniswap/uniswap-interface

Deploying via IPFS might work indeed, but you're then either reliant on a gateway or have to run IPFS yourself locally. I know that Brave now supports IPFS, but for most people a more lightweight solution would be to install the Signed Pages extension for Chrome or Firefox.[0]

I'm not sure if you actually need a trustworthy backend, or rather, if the frontend is encrypting its state before sending it to the backend, then the worst a malicious backend can do is delete or replay your data. By including timestamps and replicating your state to multiple independent backends, that risk can be largely mitigated.

[0] https://github.com/tasn/webext-signed-pages

Are there recorded cases of this ever happening?

Lavabit. Iirc they were asked to compromise thier own server as part of the snowden investigation. Instead they closed up shop. I lost a couple email addresses with the, but was glad to do so rather than explain to legal clients how thier data was on an fbi-controlled sever. Sometimes the only way to win is not to play.

https://www.cbc.ca/news/business/lavabit-founder-fought-9-mo...

With your nickname the comment makes for an eerie read :)

https://en.wikipedia.org/wiki/Sandworm_(hacker_group)

It is also one of the oldest concepts in scifi. I never met a hacker who wasnt also some sort of scifi fan. The people picking hacker groups names all read Hebert long ago. If you are old enough to have used lavabit, you probably know about sandworms.

I read it and thought of Dune.

Didn’t they famously print out their RSA private key on paper when forced to hand it over?

Use PFS..

Hushmail was forced to do that: https://www.wired.com/2007/11/hushmail-to-war/

Reply on news.ycombinator.com