3 ms·
Uhhhh... like what's the point of this? Like who is doing what they suggest folks are doing with JavaScript? Who isn't using SSL and who is rolling their own en
by rubyn00bie 7y ago
Uhhhh... like what's the point of this? Like who is doing what they suggest folks are doing with JavaScript? Who isn't using SSL and who is rolling their own encryption layer?
It seems like a clickbait rant more than something actionable or even really relevant. They even go on to say in the article you totally can do crypto "right" with JS it's just really hard. Isn't that known? Isn't that why we have libraries which are audited for security vulnerabilities by experts in the field? Isn't that true for literally _every_ language/runtime/vm ? I'm not saying JavaScript's number types and quirks aren't a huge pain in the ass but so is managing memory.
/shrug just my two cents.
- geofft 7y agoThis is from 2011, when people (usually correctly) believed things like "SSL certificates are expensive," "SSL connections are expensive," "it's reasonable to host just the secure parts of your website on SSL," "if you only need authenticity and not confidentiality, it's better to avoid SSL if possible," etc. In the years since 2011, we could have implemented high-quality side-channel-resistant JS crypto libraries (plus added browser features to allow storing secret data that wasn't accessible to the website, auditing JS source, etc.), or we could have just deployed SSL everywhere. The world chose the latter, and it was a better choice.
- tptacek 7y agoThe article is talking about things like web mail providers that do in-browser OpenPGP to provide "secure email".