21–30 of 99 posts
Since I know someone will bring up the insecurity of browser crypto: this app is entirely self-contained (the HTML file can be saved and run offline).
Is there a market for end-to-end encrypted app in the browser?
Earlier quoted context omitted.
Keep in mind that today's browsers have native crypto APIs that weren't available when this was written. ( https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... )
I wasn't aware of this, and checked caniuse, nad there's already some solid support, although the standard isn't complete.
More interestingly, and recent, there is Web Crypto: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... Although I have no idea about the state of the thing.
Is there a market for end-to-end encrypted app in the browser?
Browser crypto is really problematic. For one, the client is downloading the crypto JS implementation (almost) every time they are using the app. Server compromised? crypto.js is rendered useless. HTTPS certificate compromised? crypto.js is useless. And also: XSS vuln on your website? crypto.js is useless since attacker will just exfiltrate your private key / password through XSS. The browser is wonderful for UI but…
In every one of these threads, there are inevitable comments along the lines of "in-browser crypto is inherently unsecure", which often follows to a more general "javascript crypto is inherently unsecure". This question might be slightly off-topic here, given this seems to be an in-browser library, but can anyone who knows a bit more about this topic than I comment on the state of out-of-browser JS crypto (e.g. NodeJ…
In every one of these threads, there are inevitable comments along the lines of "in-browser crypto is inherently unsecure", which often follows to a more general "javascript crypto is inherently unsecure". This question might be slightly off-topic here, given this seems to be an in-browser library, but can anyone who knows a bit more about this topic than I comment on the state of out-of-browser JS crypto (e.g. NodeJ…
One challenge is that SJCL is a very well-designed library that assumes it has no low-level primitives to work with, but in a Node environment you have native code to lean on, and you're better off doing than than using pure-Javascript crypto. But Node's native crypto is just bindings to OpenSSL --- not great.
More interestingly, and recent, there is Web Crypto: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... Although I have no idea about the state of the thing.
I feel WebCrypto (strange architectural choices made by people whose priorities are availability of crypto, not consistency of security) is even more questionable than running SJCL (a good crypto done by good people in questionable environment) in browser.