3 ms·

The main problem with Javascript cryptography called out in https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-

The main problem with Javascript cryptography called out in https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... is that the Javascript is delivered to the user's browser from the server on every view. If someone makes a web app for doing end-to-end encrypted messages between users, it can't be secure from the web server operator: the server operator can update the javascript one day to leak users' private keys to the server. The server operator could even serve that malicious change to a subset of users so that it's even less likely to be noticed. In systems where the Javascript isn't loaded on demand from a server on every use (like a server written in node.js, or an application built with electron), then that issue doesn't apply.

protomikron 9y ago
I guess your parent meant security problems due to bugs that could have been prevented using a language that has a stricter type system. This does not mean you don't have to deal with security (your case still applies), but at least you get rid of some known bugs in advance.
- AgentME 9y ago
  If it was just about type systems, then you'd expect similar outrage over web apps written in PHP, Python, and Ruby. Personally I'm a huge fan of how Flow or Typescript add a type system on top of Javascript and think anyone writing a >500 line web app would hugely benefit from using one of them.
  - protomikron 9y ago
    > If it was just about type systems, then you'd expect similar outrage over web apps written in PHP, Python, and Ruby. Oh there sure is - every discussion about programming languages is prone to typing flame wars.
bandang 9y ago
Don't see how that differs from any other language. Any program, no matter what the language its written in can send you bad code from the server you have to download it from. You also have the javascript engine/c compiler to worry about, which can of course also be malicious. Then you have the OS to worry about. Then, given all that, you have people pretending to know what they are talking about and stating they take security seriously to worry about. When clearly, all your base are belong to us.
- AgentME 9y ago
  >Don't see how that differs from any other language. Any program, no matter what the language its written in can send you bad code from the server you have to download it from. :shrug: Javascript is the one language where for its most popular uses, people download the code from a server on every use, and few if any other languages have that as the popular runtime mechanism. I'd prefer it if the article were more obvious about the issue being the download-on-run mechanism rather than being titled as if the problem were the language itself. >You also have the javascript engine/c compiler to worry about, which can of course also be malicious. Then you have the OS to worry about. ... You could say that in any discussion about security, but I'm not sure it's really useful because it seems the implication is to give up on any security problem because perfection isn't possible.
  - bandang 9y ago
    >You could say that in any discussion about security. Exactly. But no one does. Which is why you need to worry about all these guys pretending to know security. Better to assume you are not secure when you mostly are, than assume you are secure when you definately are not. With baseband processors on mobile, and management engine on x64, all security is currently broken at the hardware level anyway. Major mindset shift needed to fix that.
woranl 9y ago
Your browser can auto-update, your OS can have backdoor, drone and satellite can fly over our heads and observe our every moves. The safest way is to hide in a cave and put on tin foil hat. If one does not trust the service provider, then don't use their service. Similarly, if one cannot trust their ISP, then stay offline. Trust is critical in many things in life. If we cannot trust anyone anymore, then we have to build everything ourselves. Shit, is the cup of water in front of me safe to drink?
- AgentME 9y ago
  There's a huge range of possibilities between "I don't trust anyone and use only a CPU I made by hand and software I wrote bit by bit" and "I execute everything blindly that shadyapp.com sends me daily". Debian for example has people review everything that goes into the package repositories, has policies about what types of things are allowed, and the history of packages on the repository can be inspected. An app developer couldn't selectively deliver a malicious key-leaking version of an application to an individual user running Debian with the application installed from Debian's repository.
  - woranl 9y ago
    If one is paranoid, why trust the "people", while View Source is simply a click away. As long as one is low enough in the overall software/hardware stacks, selectivity is really not that difficult to achieve. Protection comes in layers, there is no such thing as absolute security.

protomikron 9y ago

I guess your parent meant security problems due to bugs that could have been prevented using a language that has a stricter type system. This does not mean you don't have to deal with security (your case still applies), but at least you get rid of some known bugs in advance.

AgentME 9y ago
If it was just about type systems, then you'd expect similar outrage over web apps written in PHP, Python, and Ruby. Personally I'm a huge fan of how Flow or Typescript add a type system on top of Javascript and think anyone writing a >500 line web app would hugely benefit from using one of them.
- protomikron 9y ago
  > If it was just about type systems, then you'd expect similar outrage over web apps written in PHP, Python, and Ruby. Oh there sure is - every discussion about programming languages is prone to typing flame wars.

bandang 9y ago

Don't see how that differs from any other language. Any program, no matter what the language its written in can send you bad code from the server you have to download it from. You also have the javascript engine/c compiler to worry about, which can of course also be malicious. Then you have the OS to worry about. Then, given all that, you have people pretending to know what they are talking about and stating they take security seriously to worry about. When clearly, all your base are belong to us.

AgentME 9y ago
>Don't see how that differs from any other language. Any program, no matter what the language its written in can send you bad code from the server you have to download it from. :shrug: Javascript is the one language where for its most popular uses, people download the code from a server on every use, and few if any other languages have that as the popular runtime mechanism. I'd prefer it if the article were more obvious about the issue being the download-on-run mechanism rather than being titled as if the problem were the language itself. >You also have the javascript engine/c compiler to worry about, which can of course also be malicious. Then you have the OS to worry about. ... You could say that in any discussion about security, but I'm not sure it's really useful because it seems the implication is to give up on any security problem because perfection isn't possible.
- bandang 9y ago
  >You could say that in any discussion about security. Exactly. But no one does. Which is why you need to worry about all these guys pretending to know security. Better to assume you are not secure when you mostly are, than assume you are secure when you definately are not. With baseband processors on mobile, and management engine on x64, all security is currently broken at the hardware level anyway. Major mindset shift needed to fix that.

woranl 9y ago

Your browser can auto-update, your OS can have backdoor, drone and satellite can fly over our heads and observe our every moves. The safest way is to hide in a cave and put on tin foil hat. If one does not trust the service provider, then don't use their service. Similarly, if one cannot trust their ISP, then stay offline. Trust is critical in many things in life. If we cannot trust anyone anymore, then we have to build everything ourselves. Shit, is the cup of water in front of me safe to drink?

AgentME 9y ago
There's a huge range of possibilities between "I don't trust anyone and use only a CPU I made by hand and software I wrote bit by bit" and "I execute everything blindly that shadyapp.com sends me daily". Debian for example has people review everything that goes into the package repositories, has policies about what types of things are allowed, and the history of packages on the repository can be inspected. An app developer couldn't selectively deliver a malicious key-leaking version of an application to an individual user running Debian with the application installed from Debian's repository.
- woranl 9y ago
  If one is paranoid, why trust the "people", while View Source is simply a click away. As long as one is low enough in the overall software/hardware stacks, selectivity is really not that difficult to achieve. Protection comes in layers, there is no such thing as absolute security.