5 ms·

There's a discussion going on of people who claim doing Crypto in the browser is super insecure. (Crockford is one of them) I wonder to what degree this is true

There's a discussion going on of people who claim doing Crypto in the browser is super insecure. (Crockford is one of them) I wonder to what degree this is true or what needs to be done to do at least some basic crypto in the browser like AES for personal user data.

bmh_ca 10y ago
I've written about this, here: http://stackoverflow.com/a/24677597/19212 http://stackoverflow.com/a/24677597/19212, in response to the question "Can local storage ever be considered secure?", and in particular using encryption from the SJCL. Here is the gist, copied for convenience: > There are libraries that do implement the desired functionality, e.g. Stanford Javascript Crypto Library. There are inherent weaknesses, though (as referred to in the link from @ircmaxewell's answer): - Lack of entropy / random number generation; - Lack of a secure keystore i.e. the private key must be password-protected if stored locally, or stored on the server (which bars offline access); - Lack of secure-erase; - Lack of timing characteristics. > Each of these weaknesses corresponds with a category of cryptographic compromise. In other words, while you may have "crypto" by name, it will be well below the rigour one aspires to in practice. > These concerns will likely be addressed in the WebCrypto API, but that is not here yet.
- blablabla123 10y ago
  Thanks a lot for your answer, I also read the one on SO. I'm actually thinking to use WebCrypto API for a current (kind of side-)project. I guess if you wrote a blog post about that, that could be really interesting. Until now I only heard "strong no" towards crypto in JS. Even if it's not perfect, if it can be designed towards "better than nothing". Also given that the Web is likely becoming the major platform for everything at some point in time...
  - bmh_ca 10y ago
    It looks like you could get away with WebCrypto nowadays for up-to-date mainstream browsers: http://caniuse.com/#feat=cryptography http://caniuse.com/#feat=cryptography
arkadiyt 10y ago
The only time you should ever use crypto in the browser is if you're building an end-to-end encrypted app in the browser.
- michaelchisari 10y ago
  Then encryption should be a standard API provided by the browser. We already have a level of trust in the browser for crypto implementation, we should not be relying on independent javascript code.
  - gregmac 10y ago
    > we should not be relying on independent javascript code. You mean like the code for the web app itself?
- blablabla123 10y ago
  Imagine a diary Web app, for me that would be a perfect use case. It's platform independent and you have automated backups in the Cloud - encrypted though.
  - arkadiyt 10y ago
    So, an end-to-end encrypted app in the browser?
provost 10y ago
This "discussion" has been going on for a long time. Here is an article posted to HN back in 2011 that you might be interested in: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
- amenghra 10y ago
  Keep in mind that today's browsers have native crypto APIs that weren't available when this was written. (https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...)
  - michaelchisari 10y ago
    I wasn't aware of this, and checked caniuse, nad there's already some solid support, although the standard isn't complete.
    - jcranmer 10y ago
      WebCrypto API was released as a W3C Recommendation January 26, 2017. Indeed, the working group has now shut down (they decided not to do anything about any other APIs than low-level crypto stuff...).
      - michaelchisari 10y ago
        Well, that was fast.
z3t4 10y ago
JavaScript's random generator is not cryptographically "secure" because it's not random enough. You can however make your own random generator by using keyboard/mouse input, microphone noise, etc for entropy.
- epmatsw 10y ago
  To be fair, window.crypto.getRandomValues is available back to IE11 and is cryptographically secure.
- taco_emoji 10y ago
  Looks like SJCL can do exactly that: https://github.com/bitwiseshiftleft/sjcl/blob/master/core/random.js#L242 https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ra...

bmh_ca 10y ago

I've written about this, here: http://stackoverflow.com/a/24677597/19212 http://stackoverflow.com/a/24677597/19212, in response to the question "Can local storage ever be considered secure?", and in particular using encryption from the SJCL. Here is the gist, copied for convenience: > There are libraries that do implement the desired functionality, e.g. Stanford Javascript Crypto Library. There are inherent weaknesses, though (as referred to in the link from @ircmaxewell's answer): - Lack of entropy / random number generation; - Lack of a secure keystore i.e. the private key must be password-protected if stored locally, or stored on the server (which bars offline access); - Lack of secure-erase; - Lack of timing characteristics. > Each of these weaknesses corresponds with a category of cryptographic compromise. In other words, while you may have "crypto" by name, it will be well below the rigour one aspires to in practice. > These concerns will likely be addressed in the WebCrypto API, but that is not here yet.

blablabla123 10y ago
Thanks a lot for your answer, I also read the one on SO. I'm actually thinking to use WebCrypto API for a current (kind of side-)project. I guess if you wrote a blog post about that, that could be really interesting. Until now I only heard "strong no" towards crypto in JS. Even if it's not perfect, if it can be designed towards "better than nothing". Also given that the Web is likely becoming the major platform for everything at some point in time...
- bmh_ca 10y ago
  It looks like you could get away with WebCrypto nowadays for up-to-date mainstream browsers: http://caniuse.com/#feat=cryptography http://caniuse.com/#feat=cryptography

arkadiyt 10y ago

The only time you should ever use crypto in the browser is if you're building an end-to-end encrypted app in the browser.

michaelchisari 10y ago
Then encryption should be a standard API provided by the browser. We already have a level of trust in the browser for crypto implementation, we should not be relying on independent javascript code.
- gregmac 10y ago
  > we should not be relying on independent javascript code. You mean like the code for the web app itself?
blablabla123 10y ago
Imagine a diary Web app, for me that would be a perfect use case. It's platform independent and you have automated backups in the Cloud - encrypted though.
- arkadiyt 10y ago
  So, an end-to-end encrypted app in the browser?

provost 10y ago

This "discussion" has been going on for a long time. Here is an article posted to HN back in 2011 that you might be interested in: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

amenghra 10y ago
Keep in mind that today's browsers have native crypto APIs that weren't available when this was written. (https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...)
- michaelchisari 10y ago
  I wasn't aware of this, and checked caniuse, nad there's already some solid support, although the standard isn't complete.
  - jcranmer 10y ago
    WebCrypto API was released as a W3C Recommendation January 26, 2017. Indeed, the working group has now shut down (they decided not to do anything about any other APIs than low-level crypto stuff...).
    - michaelchisari 10y ago
      Well, that was fast.

z3t4 10y ago

JavaScript's random generator is not cryptographically "secure" because it's not random enough. You can however make your own random generator by using keyboard/mouse input, microphone noise, etc for entropy.

epmatsw 10y ago
To be fair, window.crypto.getRandomValues is available back to IE11 and is cryptographically secure.
taco_emoji 10y ago
Looks like SJCL can do exactly that: https://github.com/bitwiseshiftleft/sjcl/blob/master/core/random.js#L242 https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ra...