Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kim Dotcom resigns as Mega director

couriermail.com.au

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Kim Dotcom resigns as Mega director

#21

Post by simias »

Everlag wrote: post #17
simias wrote: post #10

Earlier quoted context omitted.

I think by now everybody's already convinced that any javascript-based crypto is a joke.

Oh come one. The issue was with the developer using the environment that browsers present incorrectly and it wasn't an inherent flaw of the language. A stupid/malicious designer will always exploit features of a language to reduce/eliminate the security of the entire system. Don't be hating on js for the sake of hating on js!

It's not js that's the issue, it's the fact that the server can change the code at any time without the user being notified. So mega can backdoor its own encryption code at any time to retrieve your keys.

It's broken by design, it's not a flaw of js per se.

Re: Kim Dotcom resigns as Mega director

#22

Post by DanBC »

Everlag wrote: post #17
simias wrote: post #10

Earlier quoted context omitted.

I think by now everybody's already convinced that any javascript-based crypto is a joke.

Oh come one. The issue was with the developer using the environment that browsers present incorrectly and it wasn't an inherent flaw of the language. A stupid/malicious designer will always exploit features of a language to reduce/eliminate the security of the entire system. Don't be hating on js for the sake of hating on js!

It's not hating on JS for for the sake of it though.

Some environments are very hard for cryptography. Javascript in the browser is inherently tricky for cryptography.

Re: Kim Dotcom resigns as Mega director

#23

Post by melbourne_mat »

Mordor wrote: post #3

"To use this website, cookies must be enabled in your browser. To enable cookies, follow the instructions for your browser below." -couriermail.com.au

All the news corp (rupert murdoch owned) web sites in Australia do this now. That's one reason I don't visit them!

Re: Kim Dotcom resigns as Mega director

#24

Post by CrankyPants »

Tyrannosaurs wrote: post #19
brazzy wrote: post #9

Earlier quoted context omitted.

Given that the guy himself has a track record of massive bad-actorness, it's not exactly a shame. Assume that every single thing he does has the end goal of defrauding someone for his personal gain, and you won't be disappointed.

Yep, feels like one of those cases where you want everyone to lose somehow.

Syria!

Re: Kim Dotcom resigns as Mega director

#25

Post by josh2600 »

Everlag wrote: post #17
simias wrote: post #10

Earlier quoted context omitted.

I think by now everybody's already convinced that any javascript-based crypto is a joke.

Oh come one. The issue was with the developer using the environment that browsers present incorrectly and it wasn't an inherent flaw of the language. A stupid/malicious designer will always exploit features of a language to reduce/eliminate the security of the entire system. Don't be hating on js for the sake of hating on js!

I'm just gonna leave this here...

http://www.matasano.com/articles/javascript-cryptography/

Re: Kim Dotcom resigns as Mega director

#26

Post by mahyarm »

simias wrote: post #21
Everlag wrote: post #17

Earlier quoted context omitted.

Oh come one. The issue was with the developer using the environment that browsers present incorrectly and it wasn't an inherent flaw of the language. A stupid/malicious designer will always exploit features of a language to reduce/eliminate the security of the entire system. Don't be hating on js for the sake of hating on js!

It's not js that's the issue, it's the fact that the server can change the code at any time without the user being notified. So mega can backdoor its own encryption code at any time to retrieve your keys. It's broken by design, it's not a flaw of js per se.

Your mobile & desktop OSes etc all have a silent automatic update mechanism. Installed programs can start services silently and download executable code in the background and use it as they want. And governments take advantage of these facts regularly.

That's why they created the browser extension. It might even come signed. At least you can read the source in plain text, unlike a compiled binary.

Re: Kim Dotcom resigns as Mega director

#27

Post by pyre »

kamjam wrote: post #13
simias wrote: post #10

Earlier quoted context omitted.

I think by now everybody's already convinced that any javascript-based crypto is a joke.

It's only a joke if you don't trust the js script. Just like any encryption or software is a joke if it is untrustworthy. Unless you have the source code, it is verified and you compiled yourself, then there is always a point of weakness there. You could say the same about SSL certs and HTTPS on any website, you are blindly trusting VeriSign (or cert authority).

It's not just a matter of trust. If you verified the JS, you could trust it. The issue is that it's very easy to inject things into an HTML page on the fly. It would be like trying to say that you could trust GnuPG, but you download it from the internet and install it every single time that you use it. That's a huge attack surface.

Re: Kim Dotcom resigns as Mega director

#28

Post by rcxdude »

kamjam wrote: post #13
simias wrote: post #10

Earlier quoted context omitted.

I think by now everybody's already convinced that any javascript-based crypto is a joke.

It's only a joke if you don't trust the js script. Just like any encryption or software is a joke if it is untrustworthy. Unless you have the source code, it is verified and you compiled yourself, then there is always a point of weakness there. You could say the same about SSL certs and HTTPS on any website, you are blindly trusting VeriSign (or cert authority).

But with SSL your root certificates change rarely and you can control them, as well as freeze certificates for specific websites. With Javascript code you don't have that kind of control and if you did it would require a massive change in the approach of creating a webapp in order to be managable.

It's not an insurmountable problem though, I would like to see an attempt at solving it (a browser extension would be required, but arguably you could have much greater transparency in updates than even most package managed apps if you used readable JS).

Re: Kim Dotcom resigns as Mega director

#29

Post by kamjam »

rcxdude wrote: post #28
kamjam wrote: post #13

Earlier quoted context omitted.

It's only a joke if you don't trust the js script. Just like any encryption or software is a joke if it is untrustworthy. Unless you have the source code, it is verified and you compiled yourself, then there is always a point of weakness there. You could say the same about SSL certs and HTTPS on any website, you are blindly trusting VeriSign (or cert authority).

But with SSL your root certificates change rarely and you can control them, as well as freeze certificates for specific websites. With Javascript code you don't have that kind of control and if you did it would require a massive change in the approach of creating a webapp in order to be managable. It's not an insurmountable problem though, I would like to see an attempt at solving it (a browser extension would be req…

Fair point, and a browser extension that would detect changes in he script would be easy enough to build. The point is, for the vast majority of users, freezing certs and such is not common (I didn't know you could do that for example) and they would rely on the site to specify the cert to use.

Re: Kim Dotcom resigns as Mega director

#30

Post by mschuster91 »

nwh wrote: post #14
Achshar wrote: post #12

Earlier quoted context omitted.

They are forced to do that by law.

Australian website, there's nothing forcing them to do anything.

Aren't Australia and Great Britain "connected" by that Commonwealth stuff? I'm not an expert in international politics, but in case that Australia is bound to that cookie law in GB, that'd explain it.
Post reply on HN