3 ms·
> even looks like it's in JS to prevent most MitM attacks! The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will d
by dfranke 17y ago
> even looks like it's in JS to prevent most MitM attacks!
The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will deliver your password to a third-party server.
- bgraves 17y agoNot if you just save the JS file to your local machine, right? There's no HTTP involved in that case (which is precisely how I intended to use it).
- dfranke 17y agoProvided that the code is intact when you initially retrieve it, that solves the MITM issue. But then you're tied to that computer, and if that's acceptable, then you're far better off just using a password-keeper that uses real crypto.