Ethereum Foundation backs press-freedom tech to fight front-end hacks

A Security Gap That HTTPS Cannot Fix

The @ethereumfndn's Trillion Dollar Security (1TS) initiative has awarded a grant to the Freedom of the Press Foundation (FPF) to fund continued development of WEBCAT, an open-source browser verification tool. WEBCAT lets browsers verify that code served by an enrolled website matches what its developers published.

The grant addresses a specific and underappreciated vulnerability in how web applications work today. HTTPS authenticates the site you connect to and encrypts the connection, but it does not prove that the code the site serves matches what its developers published. Without an independent integrity check, a browser can run an altered front end without warning. For $ETH users, that creates a real risk: a tampered front end can silently swap recipient addresses or trick users into signing transactions that differ from what is displayed on screen.

When a user visits a site enrolled in WEBCAT, the browser extension verifies the application's served assets against a signed manifest before any content is executed. If verification fails, WEBCAT blocks the page from loading and shows a warning, protecting users from attacks where an attacker may compromise the server.

What the Grant Funds

The grant funds research into supporting Chrome and other Chromium browsers, help for teams adding WEBCAT to their apps, an independent security audit, and an Ethereum Request for Comments (ERC) standard so wallet developers have a common framework to follow. A wallet that integrates the library can verify enrolled sites directly, so users get the protection without installing a separate extension.

WEBCAT was not built with crypto in mind. The original problem it was designed to solve is that a compromised server could send altered code that captures content before encryption. WEBCAT is intended to detect and block that kind of alteration. SecureDrop Protocol is an ongoing research project to develop an end-to-end encrypted protocol for whistleblowing applications, allowing deployments in untrusted server environments. WEBCAT was built to protect that system, used by newsrooms worldwide to receive tips from confidential sources.

The same code-integrity risk applies when Ethereum users interact with browser-based app front ends, which is why a tool built to protect sources and journalists also fits wallets and apps. The 1TS initiative also noted that WEBCAT will complement its existing Clear Signing work. Clear Signing helps users understand what they are approving, while WEBCAT integration would help wallets verify that an enrolled app's front end matches its signed manifest.

Ethereum Foundation Blog: Announcing a Trillion Dollar Security grant for WEBCAT | SecureDrop: Introducing WEBCAT | SecureDrop: Help us test WEBCAT alpha