11–20 of 63 posts
Earlier quoted context omitted.
If you are running javascript on a page from a server, you are trusting the server with your plaintext.
Seems like browser extensions would be the way to go. Here's the SJCL demo: http://bitwiseshiftleft.github.com/sjcl/demo/
John Walker made that already at least 6 years ago: http://www.fourmilab.ch/javascrypt/ Moreover, Walker's code is public domain and he discusses security aspect, whereas the op link appears not to care about such things.
http://www.movable-type.co.uk/ contains several very useful resources for implementing JS crypto.
What does this offer over SJCL? And for those asking in the thread, JS encryption is useful in that you never have to trust a server with your plaintext.
If you are running javascript on a page from a server, you are trusting the server with your plaintext.
It's a terrible, terrible idea.
John Walker made that already at least 6 years ago: http://www.fourmilab.ch/javascrypt/ Moreover, Walker's code is public domain and he discusses security aspect, whereas the op link appears not to care about such things.
Similarly with Movable-Type's implementation: http://www.movable-type.co.uk/scripts/aes.html http://www.movable-type.co.uk/ contains several very useful resources for implementing JS crypto.
Could anyone explain what's the use case for encrypting text on a web page using JavaScript? I don't understand how this library is useful except for situation when used in Chrome extensions like the one used by LastPass. If this lib is used on a page to decrypt/encrypt user data before sending to the server, theoretically it's possible for the host to steal private key simply by injecting a JS code that copies user'…
It's the worst possible environment to implement crypto in, and you should never do it.
The killer for me has always been #7 on Nate Lawson's list: Auditability. How do you tell that your browser is using the right copy of the code to do the crypto?
Could anyone explain what's the use case for encrypting text on a web page using JavaScript? I don't understand how this library is useful except for situation when used in Chrome extensions like the one used by LastPass. If this lib is used on a page to decrypt/encrypt user data before sending to the server, theoretically it's possible for the host to steal private key simply by injecting a JS code that copies user'…
1. The people maintaining the service turned out to be not trustworthy, and have been harvesting the keys all along.
2. The hackers took control of the server and injected code to harvest the encryption keys for long enough to catch you in the net.
If you look at the relative probabilities of these two events compared to a straight-up data leak, we're looking at orders of magnitude reduction in risk. Most people who did the right thing in the past are in the habit of doing the right things, so you can lean on the host's reputation - we've been doing that for thousands of years. Code injection on the site is much less likely than the data leak, and it is a lot less fruitful for the attacker as he would have to sit there undetected and wait for enough users to punch in their keys.
Earlier quoted context omitted.
Similarly with Movable-Type's implementation: http://www.movable-type.co.uk/scripts/aes.html http://www.movable-type.co.uk/ contains several very useful resources for implementing JS crypto.
... which, implementing JS crypto, you should never do.
If your goal is to no longer be low hanging fruit for attackers, then yes, I would recommend it.