HACKER Q&A
📣 nibdo

Why browsers haven't implented code signing web pages yet?


Over years people have been asking for adding some sort of code signing for web apps, like native apps have.

But still I see no movement in this direction, although now we have plenty web apps focused on security and encryption. And every time someone tell you, that there is risk with trusting downloaded source code from server.

But why at least some browsers (or multiple forks of them) haven't implemented it yet?

This is less problems on desktops, where you can just develop some extension, but on mobiles I guess it's more complicated.

Is there risk that mobile application stores would reject such modification? Or companies/developers just don't see demand for this feature?

I don't have experience developing browsers, but I don't see this technically impossible. You don't even need some central keys repository, as you can add trusted sources manually for each site.


  👤 Juliate Accepted Answer ✓
How much improvement would this provide over web pages transmitted over SSL, practically speaking? (said another way: what’s the practical use case this would help?)

👤 neximo64
Isn't that just CSP & using the hashes for files