3 ms·
Does this scare you? I'm asking honestly, I'm currently building a password manager in react native, and thus the core crypto is all js, relying on crypto-js.
by ecesena 9y ago
Does this scare you?
I'm asking honestly, I'm currently building a password manager in react native, and thus the core crypto is all js, relying on crypto-js. Would this be a deal-breaker for you?
- doomrobo 9y agoI don't think I know enough to feel a particular way about it. All I know is that some people I respect seem to dislike it[0][1], so I've just defaulted to avoiding it where I can. [0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... [1] https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto
- roustem 9y agoThe biggest concern with WebCrypto (with the JavaScript code using WebCrypto) is the fact that you have to trust the delivery mechanism. If there is a problem with TLS then there is a potential for a MITM attack that could modify the JavaScript code. Another potential issue is phishing. It is easier to create a fake web app compared to a fake native app.