Skip to content

Commit 330d1ec

Browse files
Fix grammar (#38425)
refactor(non-cryptographic_uses_of_subtle_crypto): add comma, fix wording
1 parent b6dacb9 commit 330d1ec

File tree

1 file changed

+1
-1
lines changed
  • files/en-us/web/api/web_crypto_api/non-cryptographic_uses_of_subtle_crypto

1 file changed

+1
-1
lines changed

files/en-us/web/api/web_crypto_api/non-cryptographic_uses_of_subtle_crypto/index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ async function hashTheseFiles(e) {
9999

100100
### Where would you use this?
101101

102-
At this point you may be thinking to yourself "_I can use this on my own website, so when users go to download a file we can ensure the hashes match to reassure the user their download is secure_". Unfortunately this has two issues that immediate spring to mind:
102+
At this point you may be thinking to yourself "_I can use this on my own website, so when users go to download a file we can ensure the hashes match to reassure the user their download is secure_". Unfortunately, this has two issues that immediately spring to mind:
103103

104104
- Executable downloads should **always** be done over HTTPS. This prevents intermediate parties from performing attacks like this so it would be redundant.
105105
- If the attacker is able to replace the download file on the original server, then they can also simply replace the code which invokes the SubtleCrypto interface to bypass it and just state that everything is fine. Probably something sneaky like replacing [strict equality](/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#strict_equality_using), which can be a pain to spot in your own code:

0 commit comments

Comments
 (0)