Improving the trustworthiness of Javascript on the Web

This post introduces the Web Application Integrity, Consistency, and Transparency (WAICT) effort, a W3C-backed initiative to bring stronger security guarantees to the web. It defines web applications using integrity manifests that commit to all assets via hashes, and proposes achieving transparency by logging these hashes in public, append-only structures like hash chains. Key requirements for transparency include not breaking existing sites, no added round trips, user privacy, statelessness, non-centralization, ease of opt-in/out, transparent opt-out, and monitorability. The post details the concept of an integrity manifest with asset hashes and integrity policies, and explains how hash chains can serve as the foundation for transparently logging these manifests.