FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
1–10 of 34 posts
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#2But how safe is cryptography in JavaScript, knowingly that the language allows funny mathematics and comparison results?
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#3Doing cryptography in the browser is a bad idea: https://tonyarcieri.com/whats-wrong-with-webcrypto
Also https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#4But how safe is cryptography in JavaScript, knowingly that the language allows funny mathematics and comparison results?
I had to do a little digging into where it was pulling its crypto methods from and it looks like the have a bit of their own library, but it uses libsodium via javascript wrappers underneath:
https://github.com/TankerHQ/sdk-js/tree/master/packages/cryp...
https://github.com/jedisct1/libsodium.js
So, I guess take that as you will. I haven't read much of the actual source yet.
edit: I sort of expected there would be a move to the server since it looks like they built their library to run on the server, even if it's running all of the libsodium methods in javascript but it's definitely pulling the browser version and running it all in the client: https://github.com/TankerHQ/sdk-js/blob/master/packages/file...
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#5Doing cryptography in the browser is a bad idea: https://tonyarcieri.com/whats-wrong-with-webcrypto Also https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
Browser crypto has come a long way. With libraries like libsodium and proper implementation I think it’s drastically better than at the time of those articles (2013 and 2011).
Source: we also write encryption libraries and have a free implementation of our browser sdk at https://share.labs.tozny.com
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#6Doing cryptography in the browser is a bad idea: https://tonyarcieri.com/whats-wrong-with-webcrypto Also https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
Browser crypto has come a long way. With libraries like libsodium and proper implementation I think it’s drastically better than at the time of those articles (2013 and 2011). Source: we also write encryption libraries and have a free implementation of our browser sdk at https://share.labs.tozny.com
No, it's not drastically better than it was in 2013.
People have done lots of things with browser cryptography, that's true. But none of what they've done addresses or mitigates the central flaw of browser javascript cryptography, which is that to use it, you have to continuously and durably trust the server. If you're doing that, you might as well just do the cryptography serverside.
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#7But how safe is cryptography in JavaScript, knowingly that the language allows funny mathematics and comparison results?
JavaScript itself is quite safe, more so if it's running isolated like in a browser. Trusting your data to a piece of JavaScript code sent by a remote server, though, is only as safe as the server.
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#8Doing cryptography in the browser is a bad idea: https://tonyarcieri.com/whats-wrong-with-webcrypto Also https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
The author of that second one is a frequent HN commentator. Let me attempt to summon him to this thread to see if he has anything more to say, since that was written in 2011 so might be a bit out date.
Begin summoning ritual...
• It's easy to secure email with GPG.
• DNSSEC is a state of the art design that you should adopt on your website as soon as possible, to make up for the deficiencies of TLS.
• You should use /dev/random for most cryptographic random number generation on Linux. /dev/urandom is only good for things where security doesn't matter.
...end summoning ritual.
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#9Doing cryptography in the browser is a bad idea: https://tonyarcieri.com/whats-wrong-with-webcrypto Also https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
The author of that second one is a frequent HN commentator. Let me attempt to summon him to this thread to see if he has anything more to say, since that was written in 2011 so might be a bit out date. Begin summoning ritual... • It's easy to secure email with GPG. • DNSSEC is a state of the art design that you should adopt on your website as soon as possible, to make up for the deficiencies of TLS. • You should use…
I only have an alert set up on DNSSEC, for what it's worth. I won't notice most GPG or /dev/random arguments.
(Thankfully, the /dev/random debate is moribund).
Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript
#10But how safe is cryptography in JavaScript, knowingly that the language allows funny mathematics and comparison results?
JavaScript itself is quite safe, more so if it's running isolated like in a browser. Trusting your data to a piece of JavaScript code sent by a remote server, though, is only as safe as the server.
The "safety" being discussed here isn't system integrity, but rather cryptographic side channel safety, which is very much an open question in Javascript.