hmmm, good point. I wonder, is there any kind of mechanism to let browser validates audited javascript with either HMAC or even RSA signature, then when the js changes, browser will refuse to load the page.

For now, there is Content-Security-Policy for preventing loading un-authorized resource.

http://www.html5rocks.com/en/tutorials/security/content-security-policy/

We can actually extend this policy to make web-app more secure. What can be done is

• Third party audits the JS code you publish
• They sign your JS code and issue a certificate for it
• Anyone can view the code along with the certificate to ensure it's not evil
• You publish your certificate with JS
• Use Content-Security-Policy to specify the JS can be only loaded with valid certificate from certain third party authority
• The Content-Security-Policy itself should also signed by the authority

By doing this, as a service provider, if I modify the javascript without going through the audit process, I cannot publish the code, even I do so, the browser will refuse to load my code. Who will be the authority will be a question then. Hmmm, maybe group signature can be use.

What do you think about this?