5 ms·

Is there a market for end-to-end encrypted app in the browser?

by woranl 10y ago

baby 10y ago
Two things come to my mind, cryptocat and the PGP plugin for Gmail. Now, are they useful and used? I don't know...
roustem 10y ago
We are using WebCrypto in 1Password.com implementation and polyfill with SJCL when a browser does not support the algorithms we need (PBKDF2, AES-GCM in Safari, etc).
- Akkuma 10y ago
  We do the same thing at Virtru.
9gunpi 10y ago
Obviously there would be many web apps which would benefit from being end-to-end and not loose a lot in usability compared to non e2e ones
Akkuma 10y ago
Yes there certainly is a market for that. I work at Virtru, which is essentially doing encryption in the browser for your content and then decrypting in the browser.
orthecreedence 10y ago
Yes, kind of. I use SJCL in Turtl (https://turtlapp.com https://turtlapp.com) which is packaged as standalone browser app (nwjs on desktop, xwalk on android). I'd never publish the app as a web app (at least not without significant warnings to the user/an opt-in) but technically yes, we use client-side crypto in a browser. SJCL is kind of a pain in the ass though, to be honest. It was built before Uint8Array was prevalent, meaning all your crypto data has to be encoded as a string, and you have to be extra cautious of UTF8 data (you have to decode/encode your data as ASCII strings). Someone please correct me if this is no longer the case. Recently I've been playing with the emscripten port of libsodium (https://github.com/jedisct1/libsodium.js https://github.com/jedisct1/libsodium.js), which seems to be working quite well. I have yet to benchmark, but the nice thing is that eventually I can replace parts of the app with Rust (WIP) and use the exact same library for crypto as used in the js app. So, I'd agree in general that javascript is a shitty language for crypto, or at least it was before Uint8Array et al. I'm looking forward to seeing what happens with Wasm...being able to replace a JS app with low-level code compiled from Rust or something is definitely a nice idea. My ultimate goal was to provide a comm layer between JS <--> Rust and embed the Rust portion of the app as a library (.dll/.so/etc) but perhaps it just makes sense to compile everything to Wasm and embed it that way.
gglitch 10y ago
Tiddlywiki uses SJCL

Is there a market for end-to-end encrypted app in the browser?

by woranl 10y ago

Is there a market for end-to-end encrypted app in the browser?

baby 10y ago

Two things come to my mind, cryptocat and the PGP plugin for Gmail. Now, are they useful and used? I don't know...

roustem 10y ago

We are using WebCrypto in 1Password.com implementation and polyfill with SJCL when a browser does not support the algorithms we need (PBKDF2, AES-GCM in Safari, etc).

Akkuma 10y ago
We do the same thing at Virtru.

9gunpi 10y ago

Obviously there would be many web apps which would benefit from being end-to-end and not loose a lot in usability compared to non e2e ones

Akkuma 10y ago

Yes there certainly is a market for that. I work at Virtru, which is essentially doing encryption in the browser for your content and then decrypting in the browser.

orthecreedence 10y ago

Yes, kind of. I use SJCL in Turtl (https://turtlapp.com https://turtlapp.com) which is packaged as standalone browser app (nwjs on desktop, xwalk on android). I'd never publish the app as a web app (at least not without significant warnings to the user/an opt-in) but technically yes, we use client-side crypto in a browser. SJCL is kind of a pain in the ass though, to be honest. It was built before Uint8Array was prevalent, meaning all your crypto data has to be encoded as a string, and you have to be extra cautious of UTF8 data (you have to decode/encode your data as ASCII strings). Someone please correct me if this is no longer the case. Recently I've been playing with the emscripten port of libsodium (https://github.com/jedisct1/libsodium.js https://github.com/jedisct1/libsodium.js), which seems to be working quite well. I have yet to benchmark, but the nice thing is that eventually I can replace parts of the app with Rust (WIP) and use the exact same library for crypto as used in the js app. So, I'd agree in general that javascript is a shitty language for crypto, or at least it was before Uint8Array et al. I'm looking forward to seeing what happens with Wasm...being able to replace a JS app with low-level code compiled from Rust or something is definitely a nice idea. My ultimate goal was to provide a comm layer between JS <--> Rust and embed the Rust portion of the app as a library (.dll/.so/etc) but perhaps it just makes sense to compile everything to Wasm and embed it that way.

gglitch 10y ago

Tiddlywiki uses SJCL