2 ms·
That's right. If you have no HTTPS, I can strip the JS/WASM that does encryption and fetch your cleartext password when you POST it back. If there is HTTPS I c
by dullgiulio 9y ago
That's right. If you have no HTTPS, I can strip the JS/WASM that does encryption and fetch your cleartext password when you POST it back.
If there is HTTPS I cannot strip the JS/WASM that does crypto... but you don't need user-side crypto any more.
- ThePhysicist 9y agoThere might be situations when you want client-side crypto not for sending data over the network, but to securely encrypt a document that you want to send / use in a different context. Using an emscripten-compiled crypto library would allow you to do this in your browser without sending any of the data over the wire.
- dullgiulio 9y agoAlright, but everything can still be tampered. At best, you can cause a denial of service, at worst modify a document that a user signs has its own.