Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scramble.io: secure email for everyone

dcposch.github.io

Post reply on HN
Print view View original

41–50 of 142 posts

Re: Scramble.io: secure email for everyone

#41

Post by j1vms »

ozh wrote: post #23
DigitalJack wrote: post #9

Earlier quoted context omitted.

I'm not a programmer. Why can't you just digest or hash the JS?

Just curious : what does a non-programmer come to HN for? Everything seems fairly programming centric to me here...

There is a lot of stuff on HN, with a slim majority being programmer-centric. HN is a place to pique one's intellectual curiosity regardless of coding background. I think there's a lot of coding stuff here because we happen to be on computers to access HN and, as people who are curious, we're likely to have already dabbled in tuning or coding for the computers we are on and other systems.

Re: Scramble.io: secure email for everyone

#42

Post by blakerson »

RokStdy wrote: post #36
ozh wrote: post #23

Earlier quoted context omitted.

Just curious : what does a non-programmer come to HN for? Everything seems fairly programming centric to me here...

To broaden their horizons? Because they're interested in technology even if they don't define themselves as a programmer? Just curious: why would a person comment not to add value, but to ask a semi-snarky rhetorical question?

While plenty of comments here are snarky, I didn't think that particular question was.

Re: Scramble.io: secure email for everyone

#43

Post by tptacek »

revdinosaur wrote: post #38
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Just to clarify, as I've seen many of your responses to posts on this subject, you're advocating against use of javascript encryption in client-side applications served through the browser. If the encryption library were running on a server using node.js or packaged into a mobile app using a framework like Phonegap it doesn't matter that the implementation is in javascript, does it?

The issue is with browser Javascript, specifically with sensitive Javascript that has to coexist in the same runtime and even the same variable scope as content-controlled code.

Re: Scramble.io: secure email for everyone

#44

Post by jahewson »

revdinosaur wrote: post #38
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Just to clarify, as I've seen many of your responses to posts on this subject, you're advocating against use of javascript encryption in client-side applications served through the browser. If the encryption library were running on a server using node.js or packaged into a mobile app using a framework like Phonegap it doesn't matter that the implementation is in javascript, does it?

Indeed, there's nothing wrong with using node.js' bindings to OpenSSL. It's crypto in the browser which creates the chicken-and-egg problem.

Re: Scramble.io: secure email for everyone

#45

Post by jmccree »

special wrote: post #13
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Wouldn't that require the user to install the browser extension to use the service? That would lock out a lot of people that would find this service useful (eg. Tails users).

Worrying about strong crypto in browser JS is like installing a vault door to secure a room partitioned with drywall.

Re: Scramble.io: secure email for everyone

#46

Post by tptacek »

dcposch wrote: post #40
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Yeah, I read your Matasano post, "Javascript crypto considered harmful", and I agree-- Javascript crypto is hard! But it's not impossible. The reason I chose that route is because I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required. I think that security is at least equal parts a technical problem and an adoption problem. The status quo is that nearly al…

It is impossible. The features required to make browser Javascript safe for crypto aren't even on the roadmaps of browser vendors.

Your reason for using browser Javascript for crypto --- here, Recurity's JS PGP implementation --- is the same as every other JS crypto project's reason: doing everything in the browser makes it easier for users to adopt your project. You are not the first person to point this out and you won't be the last.

The problem is, you acknowledge one side of this design ("it's super easy for users") and ignore the other ("it's fatal to security").

Here, you even acknowledge that there was a simple mechanism available to you that might have marginally improved security (packaging the whole application as a Chrome extension). But that made your life too hard! So you abandoned that idea and just made all the crypto downloadable from the server on HTML pages!

Re: Scramble.io: secure email for everyone

#47

Post by hershel »

revdinosaur wrote: post #38
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Just to clarify, as I've seen many of your responses to posts on this subject, you're advocating against use of javascript encryption in client-side applications served through the browser. If the encryption library were running on a server using node.js or packaged into a mobile app using a framework like Phonegap it doesn't matter that the implementation is in javascript, does it?

This relatively old webpage[1] talks about the possibility of side channel attacks in javascript(among other things).I believe this applies to Phonegap.

[1]https://hellais.wordpress.com/2011/12/27/how-to-improve-java...

Re: Scramble.io: secure email for everyone

#48

Post by bentcorner »

ozh wrote: post #23
DigitalJack wrote: post #9

Earlier quoted context omitted.

I'm not a programmer. Why can't you just digest or hash the JS?

Just curious : what does a non-programmer come to HN for? Everything seems fairly programming centric to me here...

DigitalJack might claim to not be a programmer, but if s/he knows enough to ask "Why can't you just digest or hash the JS?", that's pretty programmery.

Besides, "Programming" is a large spectrum; I know jack-all about javascript but am comfortable building CRUD apps in C# and am in the intended audience of "don't build your own crypto because you're an idiot" blog posts. I consider myself a programmer (even though I have a lot to learn) and had the same question in my head as DigitalJack.

Re: Scramble.io: secure email for everyone

#50

Post by jahewson »

dcposch wrote: post #40
tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

Yeah, I read your Matasano post, "Javascript crypto considered harmful", and I agree-- Javascript crypto is hard! But it's not impossible. The reason I chose that route is because I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required. I think that security is at least equal parts a technical problem and an adoption problem. The status quo is that nearly al…

Two big questions:

1. How do you revoke a compromised signature comitee certificate embedded in the browser extension?

2. How can you prevent a hostile browser extension from hijacking the validation process?

Post reply on HN