4 ms·

That's the problem with "client-side encryption". It doesn't work because the provider also has the power to replace the code with no say from you. And it's no

by iofj 11y ago

That's the problem with "client-side encryption". It doesn't work because the provider also has the power to replace the code with no say from you. And it's not very detectible because they do it all the time.

kuschku 11y ago
It’s the same reason why any DRM is completely pointless: It only provides inconvenience for the legitimate user. I own Anno 2070 (as can be seen on my steam profile), but can only play with RELOADED crack under wine because UPlay refuses to run. Same with this type of encryption: Kazahstan can easily defeat it, but it makes it harder for people trying to debug why they can’t use Netflix (for example, in case that Kazahstan MitM's everything, and encrypts with a different certificate than your Netflix client is using).
pdkl95 11y ago
Client side encryption works just fine. It's only a problem in a browser where you have to download the possibly-MitM'd program each time you want to use it. Actual installed client software that encrypts end-to-end is the proper way to use encryption. One catch: remember that the browser itself absolutely should not be the installed program doing the end-to-end encryption, where bugs can allow the private keys to be leaked. Important data like the private keys shouldn't even be in the same address space. See gpg-agent/ssh-agent as an examples of how to keep sensitive data in a separate process.
- tptacek 11y ago
  Nit: you are effectively re-downloading browser DOM JS crypto programs every time your browser loads a new DOM element for the page hosting the app. It's not just something that happens when you first visit the site. That's one of the things that makes securing browser JS crypto so intractable.
  - pdkl95 11y ago
    Meh; you can't trust the first version anyway, which makes anything happening later on the page just as broken. If it's an additional source being added much later on that you are concerned with, that's always been a broken design that Douglas Crockford warned[1] about years ago. [1] https://www.youtube.com/watch?v=V13wmj88Zx8 https://www.youtube.com/watch?v=V13wmj88Zx8

by iofj 11y ago

kuschku 11y ago

It’s the same reason why any DRM is completely pointless: It only provides inconvenience for the legitimate user. I own Anno 2070 (as can be seen on my steam profile), but can only play with RELOADED crack under wine because UPlay refuses to run. Same with this type of encryption: Kazahstan can easily defeat it, but it makes it harder for people trying to debug why they can’t use Netflix (for example, in case that Kazahstan MitM's everything, and encrypts with a different certificate than your Netflix client is using).

pdkl95 11y ago

Client side encryption works just fine. It's only a problem in a browser where you have to download the possibly-MitM'd program each time you want to use it. Actual installed client software that encrypts end-to-end is the proper way to use encryption. One catch: remember that the browser itself absolutely should not be the installed program doing the end-to-end encryption, where bugs can allow the private keys to be leaked. Important data like the private keys shouldn't even be in the same address space. See gpg-agent/ssh-agent as an examples of how to keep sensitive data in a separate process.

tptacek 11y ago
Nit: you are effectively re-downloading browser DOM JS crypto programs every time your browser loads a new DOM element for the page hosting the app. It's not just something that happens when you first visit the site. That's one of the things that makes securing browser JS crypto so intractable.
- pdkl95 11y ago
  Meh; you can't trust the first version anyway, which makes anything happening later on the page just as broken. If it's an additional source being added much later on that you are concerned with, that's always been a broken design that Douglas Crockford warned[1] about years ago. [1] https://www.youtube.com/watch?v=V13wmj88Zx8 https://www.youtube.com/watch?v=V13wmj88Zx8