I'm building a website with Rust and WebAssembly where browsers connect to one another and exchange data. For example, a browser might receive data A from several peers, receive data B later, hash or compare the values using Merkle-tree-style verification, and then share the result with other browsers. Can a malicious user modify the WebAssembly or JavaScript logic in their browser so it sends false data or performs incorrect verification? Is there any reliable way to detect that a user has altered the client and warn other browsers that the peer is malicious?
3 Answers
Peer-to-peer systems should assume that any participant may be malicious. Merkle proofs can show that data matches a particular hash or tree, but they do not prove that the original data was honest or that the peer followed your verification code. Keep the API and server-side validation defensive, and treat every client-supplied value as untrusted.
Yes. Anything that runs on the user’s device—including WebAssembly, JavaScript, and browser extensions—should be treated as modifiable. A user can alter the code, intercept or edit network traffic, or skip the browser entirely and send requests with their own program. Other peers have no reliable way to prove what code is actually running on that device.
WebAssembly improves performance and portability, but it does not provide trust or security against the person running it. Client-side checks can be useful for convenience, but they cannot be the final authority when peers can submit incorrect data. Validate important operations on a server you control, or design a protocol with cryptographic signatures, quorum rules, reputation, or another explicit trust model.
Would using a browser extension make the logic harder to alter, or could users modify that too?