4 ms·

It's interesting that the very security minded disable javascript in their browser for security reasons, which makes most client-side crypto not possible.

privacy101 11y ago
Do they disable it globally or selectively enable it?
- brobinson 11y ago
  Both, as far as I know. Plugins like NoScript disable it globally and allow you to whitelist domains/subdomains.
anon1385 11y ago
The people disabling javascript are also probably aware that javascript crypto is utterly pointless with the current browser security model. Javascript crypto aims to protect you from the server, but you must rely on the server sending javascript that actually does the encryption. When it can't protect you against the adversary it's design to protect you against then what is the point? Imagine a client-side-encrypted version of google docs that always encrypts your document before sending it back to the google servers. Any time you visit the site google could send you a modified version of the site javascript (possibly at the request of security services) that just uploads the document without encrypting it first. Browsers currently have no way to prevent that or even notifying you that it's happening. If you want to do client side crypto you need to do it in native apps. The web is just too technically limited to support building platforms on top of it that have different trust models.
- wnortje 11y ago
  > Imagine a client-side-encrypted version of....... The project I am working on aims to facilitate these kinds of apps. It is a native app which have both a CLI interface and (used to before I broke it) an HTTP interface. The idea is that websites gets proxied through the app. All data gets stripped out and encrypted before being sent anywhere. Websites must be aware that this is going to happen for them to work. Unaware sites won't work. All or nothing. The project site is https://www.selectiveshare.com https://www.selectiveshare.com. I am currently working on a second project which uses the CLI interface. The HTTP interface will remain broken for some time.

privacy101 11y ago

Do they disable it globally or selectively enable it?

brobinson 11y ago
Both, as far as I know. Plugins like NoScript disable it globally and allow you to whitelist domains/subdomains.

anon1385 11y ago

The people disabling javascript are also probably aware that javascript crypto is utterly pointless with the current browser security model. Javascript crypto aims to protect you from the server, but you must rely on the server sending javascript that actually does the encryption. When it can't protect you against the adversary it's design to protect you against then what is the point? Imagine a client-side-encrypted version of google docs that always encrypts your document before sending it back to the google servers. Any time you visit the site google could send you a modified version of the site javascript (possibly at the request of security services) that just uploads the document without encrypting it first. Browsers currently have no way to prevent that or even notifying you that it's happening. If you want to do client side crypto you need to do it in native apps. The web is just too technically limited to support building platforms on top of it that have different trust models.

wnortje 11y ago
> Imagine a client-side-encrypted version of....... The project I am working on aims to facilitate these kinds of apps. It is a native app which have both a CLI interface and (used to before I broke it) an HTTP interface. The idea is that websites gets proxied through the app. All data gets stripped out and encrypted before being sent anywhere. Websites must be aware that this is going to happen for them to work. Unaware sites won't work. All or nothing. The project site is https://www.selectiveshare.com https://www.selectiveshare.com. I am currently working on a second project which uses the CLI interface. The HTTP interface will remain broken for some time.