4 ms·

A question - does it matter for webcrypto API's trustability to have window.crypto be redefinable to anything a piece of JavaScript code desires? (Ex: extension

by sriku 10y ago

A question - does it matter for webcrypto API's trustability to have window.crypto be redefinable to anything a piece of JavaScript code desires? (Ex: extensions) I find it hard to make any claims about safe local encryption using webcrypto API if, post encryption, a new extension can be installed that will sniff the keys as you decrypt to access your data. Thoughts?

Klathmon 10y ago
In the browser, extensions can be thought of as programs with root permissions in many cases. They can do anything to the page. But this isn't new to the web, your kernel can be "changed" if you give something permission to change it and that kernel can sniff your keys as well. There's definitely a "societal" issue around how much power extensions have, but I don't think it's any different than most "platforms" in that if you give something root, it can do anything.
- sriku 10y ago
  At this point, my browser's (Chrome's) URL bar reads "Secure | https://news.ycombinator.com/...." https://news.ycombinator.com/....". I have quite a few extensions loaded including ad blockers. Is the "Secure" statement trustable? Should window.crypto be trustable in the same way? ... as a guarantee provided by the browser in spite of extensions? Is that even possible?
  - Klathmon 10y ago
    Well it's secure in that the connection between you and ycombinator is secure. But any of your extensions that have permission to modify the page, can be modifying it in any way shape or form. So they could be rewriting my comment, they could be calling out to external servers sending all the contents of your page, they could be recording every keystroke on that page, and more. So no, you can't trust that "Secure" statement absolutely. And while the browser could make window.crypto immutable or "un modifiable", it would be a false sense of security as an extension could just get the result from the page when it's put into the DOM.

by sriku 10y ago

Klathmon 10y ago

In the browser, extensions can be thought of as programs with root permissions in many cases. They can do anything to the page. But this isn't new to the web, your kernel can be "changed" if you give something permission to change it and that kernel can sniff your keys as well. There's definitely a "societal" issue around how much power extensions have, but I don't think it's any different than most "platforms" in that if you give something root, it can do anything.

sriku 10y ago
At this point, my browser's (Chrome's) URL bar reads "Secure | https://news.ycombinator.com/...." https://news.ycombinator.com/....". I have quite a few extensions loaded including ad blockers. Is the "Secure" statement trustable? Should window.crypto be trustable in the same way? ... as a guarantee provided by the browser in spite of extensions? Is that even possible?
- Klathmon 10y ago
  Well it's secure in that the connection between you and ycombinator is secure. But any of your extensions that have permission to modify the page, can be modifying it in any way shape or form. So they could be rewriting my comment, they could be calling out to external servers sending all the contents of your page, they could be recording every keystroke on that page, and more. So no, you can't trust that "Secure" statement absolutely. And while the browser could make window.crypto immutable or "un modifiable", it would be a false sense of security as an extension could just get the result from the page when it's put into the DOM.