I like how they don't flaunt crypto terms all over the place. Calling encrypted content "gibberish" is fun.
And I think it's a genius use-case for Service Workers. From their security page[0]: "we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps[sic] on all other code, and checks that it matches the publicly available version on GitHub."
Combine this with HSTS, and you can be certain the code running hasn't been modified by a third-party.
To be precise: If it works as described, it makes it (a little? substantially? orders of magnitude?) more difficult for third parties to modify the code.
Very true. You probably still need to trust that the developers' Github accounts aren't compromised. I was looking at their repo[0] for this Service Worker verification, and their "So what's the problem this solves?" section confuses me, as it doesn't explain the how. :/
While a hacker gaining access to the developers' GitHub account would be bad, they would still have to actually push the malicious code to GitHub before they can serve it from airborn.io. So, if people pay attention to pushes to GitHub, this attack could still be detected (but not prevented). For prevention, one possibility would be to require all commits to have been on GitHub for at least 24h or so. Then, the devs would have some time to try and get their accounts back. We don't implement that today, though.
That section attempts to explain how web apps work today, if you don't use that library. Reading the entire thing back, I agree that the how is never explained very well, although https://www.airborn.io/docs/security does explain it.
And I think it's a genius use-case for Service Workers. From their security page[0]: "we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps[sic] on all other code, and checks that it matches the publicly available version on GitHub."
Combine this with HSTS, and you can be certain the code running hasn't been modified by a third-party.
[0] https://www.airborn.io/docs/security