4 ms·
I just developed a browser to server based crytpo channel meant to replace the SLL certificate mess on a side project I'm working on. I know that there's a bad
by kruhft 11y ago
I just developed a browser to server based crytpo channel meant to replace the SLL certificate mess on a side project I'm working on. I know that there's a bad rap for browser based crytpo and rolling your own but I've got some knowledge and thought I would give it a shot.
The code is not public (yet) but uses DH key exchange (using the JS BigInt library) to exchange a 2048 bit token key and then uses sjcl to perform encryption on each packet/request using the resulting key.
It's lacking host validation (am I talking to the correct server?), but I'm still working getting that piece together.
- kruhft 11y agoAnybody care to comment rather than just downvote? I wouldn't mind hearing some thoughts regarding this part of the project.
- stephengillie 11y agoPlease resist commenting about being downvoted. It never does any good, and it makes boring reading. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- mikekchar 11y agoComplaint about complaint about downvoting notwithstanding, my guess as to why nobody commented was: there is no meaningful way to comment on it. There is no link with a detailed description of what you have done, or demonstration of how it works. There is also no source code to look at yet. While I am sure it is an exciting project for you, without something that people can try (or at least source code to look at), it doesn't add anything valuable to the reader of the comment. It just adds to the noise of the conversation. If you wait until you are ready to show people the code, then I'm sure many people will be interested to discuss it. Before that, it's not time yet. That's my perspective, anyway. I hope it is useful to you.