Improving the Trustworthiness of Javascript on the Web
No ratings
Presented at Real World Crypto 2026 by
The web is the universal application platform, but there are some applications you cannot safely run in a browser today. Consider an end-to-end encrypted messenger whose encryption code executes entirely client-side in Javascript. There is nothing preventing the server from sending a specific user some malicious Javascript code to exfiltrate all their messages. Further, this attack would be effectively undetectable by the user, and leave no trace. Smartphone apps don't have this problem. This is because app stores perform lots of security-specific operations: they scan for known malware, they verify developers’ code signing, they show developers all apps deployed under their developer ID, and they distribute the same binary to every end user. It would be nice if we could achieve app store-like guarantees for web applications, without the centralizing effects of a private app store. In this talk, we discuss efforts among browser vendors, cloud providers, and encrypted communication developers to bring app store-like security guarantees to the entire web. We will present an overview of already deployed systems—CodeVerify by Meta and WEBCAT by the Freedom of the Press Foundation—as well as a developing standard called Web Application Integrity, Consistency, and Transparency (WAICT), which aims to unify these approaches, embed them natively in browsers, and scale these guarantees across the whole web.