Web Content Integrity: Tamper-Proof Websites Beyond HTTPS

The chapter introduces Web Content Integrity (WCI), a framework designed to cryptographically verify the integrity of web content beyond the protections offered by HTTPS. It addresses the vulnerability of web servers to tampering, which can lead to the distribution of false or misleading information, extraction of secret data, or the spread of malware. WCI ensures that visitors to a website receive only content that has not been altered by creating an index of URLs and corresponding cryptographic hashes of the content. This index is then published in the Domain Name System (DNS) alongside the domain name entries. The chapter outlines the framework's design, including the creation and verification of the WCI index, and discusses its applicability, compatibility with existing web infrastructure, potential attacks, and overheads. It also provides a migration path for dynamic websites and demonstrates the automation of the creation of necessary data structures. The chapter concludes by highlighting the benefits of WCI in providing advanced integrity guarantees for static websites and facilitating its adoption through automated tools.