We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of a server could tamper with the JS to steal a user's credentials the next time they log in.)
Baffling. If you're going to build a browser extension, put the crypto code in the extension. This still isn't a great solution, but it's better than trying to "verify the Javascript code". How exactly do you plan to do that? Surely you realize you can't just digest the JS asset files.
https://news.ycombinator.com/item?id=6637915
https://news.ycombinator.com/item?id=6420739
https://news.ycombinator.com/item?id=6353137
https://news.ycombinator.com/item?id=6317685
(That's just the last few weeks).
We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of a server could tamper with the JS to steal a user's credentials the next time they log in.)
Baffling. If you're going to build a browser extension, put the crypto code in the extension. This still isn't a great solution, but it's better than trying to "verify the Javascript code". How exactly do you plan to do that? Surely you realize you can't just digest the JS asset files.