The Ethereum Foundation’s Trillion Dollar Security (1TS) initiative is proud to announce a grant allocation to Freedom of the Press Foundation (FPF) to support the continued development of WEBCAT. WEBCAT is an open source tool that lets browsers verify that code served by an enrolled website matches what its developers published. The grant will also help bring that protection to Ethereum wallets and apps.
Closing the front-end verification gap
The grant targets a gap in how web applications are secured today. HTTPS authenticates the site you connect to and encrypts the connection, but it does not prove that the code the site serves matches what its developers published. Without an independent integrity check, a browser can run an altered front end without warning.
For Ethereum users, the risk lies in the app’s website itself. Your browser loads and executes the site’s code when you visit. Tampered code there can swap the recipient address or ask you to sign something other than what the page showed. Your wallet cannot determine from the connection alone whether the page has been altered.
Trillion Dollar Security has identified front-end hacks as an infrastructure risk and verifiable front ends as a next step. Compromised web interfaces can expose users to supply-chain attacks and UI manipulation, and can increase the impact of incidents like DNS hijacks.
About WEBCAT
WEBCAT, short for web-based code assurance and transparency, lets a browser verify that the resources served by an enrolled site match a signed manifest. If verification fails, the current alpha Firefox extension prevents the page from loading and displays a warning.
Developers sign a manifest describing the files and other assets covered by each release. A distributed, verifiable enrollment system maintains a public record. For each participating site, that record holds a cryptographic fingerprint of enrollment information that specifies the site’s authorized signing identities and validation rules. The extension periodically downloads and verifies a snapshot of the record, so it can verify enrolled sites locally without contacting a third party on every visit.
FPF developed WEBCAT in part because a future version of SecureDrop will need verifiable browser code. SecureDrop is FPF’s open source submission system for secure communication between journalists and anonymous sources.
Today, SecureDrop encrypts submissions on the newsroom’s server as they are uploaded. The server handles unencrypted content during upload but stores submissions in encrypted form. FPF is developing an end-to-end encryption protocol for a future version of SecureDrop. Under the intended design, the source’s browser would encrypt message content before sending it, so the server would store ciphertext rather than hold plaintext in memory until encrypted by the server. The protocol remains under development and does not yet cover file attachments.
Because the encryption code would still come from the server, a compromised server could send altered code that captures content before encryption. WEBCAT is intended to detect and block that kind of alteration. FPF has also tested WEBCAT with other browser-based secure applications through proof-of-concept integrations.
The same code-integrity risk applies when Ethereum users interact with browser-based app front ends, which is why a tool built to protect sources and journalists also fits wallets and apps.
What the grant funds
The grant funds the development of a WEBCAT verification library that wallets can integrate.
A wallet that includes the library can verify enrolled sites, so users get the protection without installing a separate extension. The grant also funds research into supporting Chrome and other Chromium browsers, help for teams adding WEBCAT to their apps, an independent security audit, and an Ethereum Request for Comments (ERC) standard ERC so wallet developers have a standard to follow.
The library will complement other 1TS work, including Clear Signing. Clear Signing helps users understand what they’re approving, while WEBCAT integration would help wallets verify that an enrolled app’s front end matches its signed manifest.
What’s next for wallet and app teams
Bringing this verification into wallets requires adoption on both sides. Wallet extensions must integrate the library, and app teams must enroll their domains and serve a signed manifest with each release. If you’re part of a wallet or app team interested in front-end integrity, we’d love to hear from you at trilliondollarsecurity@ethereum.org.
Read more about risk controls and priority work at trilliondollarsecurity.org.
