FileKit: An open source end-to-end encrypted cloud storage service in JavaScript • Hacker News Board

Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript

#31

Post by marcus_holmes » Fri, Aug 30, 2019, 4:37 AM UTC

jarfil wrote: post #7

IloveHN84 wrote: post #2

But how safe is cryptography in JavaScript, knowingly that the language allows funny mathematics and comparison results?

JavaScript itself is quite safe, more so if it's running isolated like in a browser. Trusting your data to a piece of JavaScript code sent by a remote server, though, is only as safe as the server.

it's not so "isolated" - running Javascript in a page can be examined and potentially altered from a number of vectors (probably the simplest is extensions).

AFAIK there's no way of running JS in a browser that is "safe" in the crypto sense.

Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript

#32

Post by blastrock » Fri, Aug 30, 2019, 7:03 AM UTC

Sephr wrote: post #30

This doesn't seem to be doing downloading in a streaming manner, as indicated by its use of my old "file-saver"[1] library. Edit: Originally thought this also did encryption without streaming. Nowadays I would recommend using Penumbra[2] (another library I've worked on) with StreamSaver.js for streaming file encryption/decryption/downloading. 1. https://github.com/eligrey/FileSaver.js 2. https://github.com/transcend-…

The encryption/upload is streamed, but the download/decryption is not, we will work on that. Thanks for the link!

Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript

#33

Post by tipiak » Fri, Aug 30, 2019, 8:21 AM UTC

tptacek wrote: post #26

javajosh wrote: post #23

Earlier quoted context omitted.

the central flaw of browser javascript cryptography, which is that to use it, you have to continuously and durably trust the server What do you think of doing JavaScript Crypto in a browser extension? An extension runs code in the browser without persistent trust of a server (at least in the traditional webapp way; you have to persistently trust the extension update server, extension authors, chrome update server, et…

I don't love browser extensions but the trust model issues with it are not identical to content-controlled Javascript.

The issue with browser extensions, is that you are not far away from the common hurdles of developing, using and releasing a "real" desktop/mobile application. Having nothing to install and landing on a page that just works, is a big plus for you users.

Re: FileKit: An open source end-to-end encrypted cloud storage service in JavaScript

#34

Post by Tomte » Fri, Aug 30, 2019, 1:48 PM UTC

tptacek wrote: post #9

tzs wrote: post #8

Earlier quoted context omitted.

The author of that second one is a frequent HN commentator. Let me attempt to summon him to this thread to see if he has anything more to say, since that was written in 2011 so might be a bit out date. Begin summoning ritual... • It's easy to secure email with GPG. • DNSSEC is a state of the art design that you should adopt on your website as soon as possible, to make up for the deficiencies of TLS. • You should use…

I only have an alert set up on DNSSEC, for what it's worth. I won't notice most GPG or /dev/random arguments. (Thankfully, the /dev/random debate is moribund).

Mostly. Just today I saw that the Arch Wiki is perpetuating the myth of /dev/urandom being insecure for crypto keys.

They even link to your and my writeup, but warn against mine, since it "contains fallacies".

The debate is never going to be decisively "won". Fortunately, enough holdouts have been convinced (Ruby, the kernel man page writers), so that the damage isn't as high anymore.