Company
Date Published
Author
Michael Rosenberg
Word count
4934
Language
English
Hacker News points
None

Summary

The concept of Web Application Integrity, Consistency, and Transparency (WAICT) is being developed to enhance the security of web applications, particularly those involving cryptography, by addressing issues such as code distribution and integrity verification. Unlike smartphone apps that benefit from app store security, web applications face challenges in ensuring the authenticity and consistency of delivered code. WAICT, supported by the W3C and involving browser vendors and encrypted communication developers, aims to create a framework that allows web applications to have similar security guarantees without centralized control. Key components include subresource integrity (SRI) and integrity manifests, which help define a coherent application by verifying assets and enforcing integrity across whole websites. Transparency is achieved by logging application versions in a publicly accessible, append-only log, with mechanisms in place to detect and monitor changes, ensuring that malicious modifications are auditable. The approach involves using hash chains for per-site logs and a prefix tree for managing enrolled sites, with a focus on maintaining openness, user privacy, and non-centralization. The system also introduces concepts like code signing for provenance and cooldown periods to prevent immediate malicious actions, with various roles like transparency services, witnesses, and asset hosts working together to maintain the system's integrity. WAICT aims to integrate additional security features over time and is in early stages of standardization, with collaborations ongoing with browsers and organizations like the IETF.