3 ms·
It's not completely useless: it's slightly helpful against an attacker that can snoop but not modify. Of course, it's pretty silly to go to the trouble of wri
by amalcon 17y ago
It's not completely useless: it's slightly helpful against an attacker that can snoop but not modify.
Of course, it's pretty silly to go to the trouble of writing javascript code that can not only be modified, but may have bugs, when you can just use HTTPS.
- tptacek 17y agoIn practical terms, there is no such attacker. The ability to watch packets in real time is the ability to silently redirect them, or to insert fake packets into the stream. The traffic manipulation part of the attack is also extremely easy, and not particularly noisy. For most applications, Javascript crypto is completely useless.
- amalcon 17y agoConsider the case of someone getting their information by triggering some sort of debug mode on the router, or using some sort of side channel. More plausibly, consider the case where someone can break your over-the-air encryption (but not in real-time). It may be extremely rare, but strictly speaking it's not impossible. That said, if option A may help in some unusual case, and option B will be effective in all non-catastrophic cases, I know which one I'd choose.