4 ms·
E2E encryption in JS in browser will never be secure. In a client with shared threads and untrusted content on the page it will always be vulnerable to timing a
by nullwasamistake 7y ago
E2E encryption in JS in browser will never be secure. In a client with shared threads and untrusted content on the page it will always be vulnerable to timing attacks. It's unrealistic to create a constant-time implementation in JavaScript.
For node/backend this is great but please don't use it on a public site.
- y96V89C668e7Q74 7y agoGenuine question - is this what you're referring to? Very curious. https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-vila.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- nullwasamistake 7y agoHadn't heard of it actually, but side channels have been an issue in browser security for a long time. Spectre caused a lot of changes in JS like disabling high precision clocks. But I'm afraid clock proxies are everywhere. The API surface is gigantic and all you need is a single call that reliably executes in constant time on the samr thread