4 ms·

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider mov

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

eran 15y ago
Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.
- tptacek 15y ago
  Even if you could somehow minify all of AES into a bookmarklet, you'd still lose any time any page this ran from requested HTML or JS from a non-HTTPS link, since any of those requests could poison the runtime.
  - nextparadigms 15y ago
    Would using SPDY help?
    - amalcon 15y ago
      Not in and of itself. Google runs SPDY over SSL, just as they also run HTTP over SSL (HTTPS). It's the SSL that makes it secure. Once you're running one protocol over SSL, you might as well run all of them over SSL. The basic problem here is that JS is too dynamic to ensure this type of security. Any script running on the page can rebind any value, monitor or trigger any event, or a number of other things. Without SSL or similar, an attacker can inject any script they want into the page. The simplest variant of such an attack would be a script that replaces your AES function with a ROT13 or other useless cipher. There are variations on this theme, and in the end it's impossible to defend against all of them.
      - abecedarius 15y ago
        Caja / Secure EcmaScript should fix the JS-too-dynamic problem. I haven't tried it out yet.
        amalcon 15y ago
        It doesn't help in this case, since an attacker can just insert plain old JS. Caja (and similar things) only help for code you can actually put through the Cajoler. It's still a good, if imperfect, solution for other use-cases.
- pixdamix 15y ago
  You would be able to get past 2048bytes using mozilla or chromium See there: https://www.squarefree.com/bookmarklets/limits.html https://www.squarefree.com/bookmarklets/limits.html I just tested a 1Mb bookmarlet on chromium and it works.
  - eran 15y ago
    Thank you for link, very interesting stats. FF also has reasonable URL limit. At least for some browsers I can do it.
- dedward 15y ago
  Don't do your self the disservice of self-signed - you can get a free cert from startssl. The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....) Just hit up startssl and get a real certificate... it's that easy. No strings attached. (Repeating this because I ignored it for about a year until actually checking it out and realizing I'd been an idiot) ALSO Given the single utility of this - just inline the scripts you need and avoid the request overhead. You can probably strip out all the functions you don't need to minimize the load time. You could offer a minimized version as well.... ALSO Very cool! Thanks!
  - eran 15y ago
    Thank you for advice about cert service! Awesome. Will request SSL cert right now. I consciously left scripts uncompressed, so anybody can look what going on behind the scene. Also, I'll publish source code on github as soon as clean it up. Then I make compressed version.
  - thwarted 15y ago
    The "other" reason to avoid a self signed cert is that a self signed cert still leaves your users open to a MITM attack. If your goal is to avoid a MITM, a self signed cert gives you nothing but more configuration lines in your webserver config.
  - rorrr 15y ago
    It's only free for one year. It's a bait.
tptacek 15y ago
He'd also need to HTTPS all the scripts that script requires, and devise some way to ensure that the script was never called from a page that itself included any HTML or JS over a non-HTTPS connection, because any of those document loads could also MITM the script. Isn't Javascript crypto fun!
eran 15y ago
MITM issue fixed, all resources are loading over SSL

eran 15y ago

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

tptacek 15y ago
Even if you could somehow minify all of AES into a bookmarklet, you'd still lose any time any page this ran from requested HTML or JS from a non-HTTPS link, since any of those requests could poison the runtime.
- nextparadigms 15y ago
  Would using SPDY help?
  - amalcon 15y ago
    Not in and of itself. Google runs SPDY over SSL, just as they also run HTTP over SSL (HTTPS). It's the SSL that makes it secure. Once you're running one protocol over SSL, you might as well run all of them over SSL. The basic problem here is that JS is too dynamic to ensure this type of security. Any script running on the page can rebind any value, monitor or trigger any event, or a number of other things. Without SSL or similar, an attacker can inject any script they want into the page. The simplest variant of such an attack would be a script that replaces your AES function with a ROT13 or other useless cipher. There are variations on this theme, and in the end it's impossible to defend against all of them.
    - abecedarius 15y ago
      Caja / Secure EcmaScript should fix the JS-too-dynamic problem. I haven't tried it out yet.
      - amalcon 15y ago
        It doesn't help in this case, since an attacker can just insert plain old JS. Caja (and similar things) only help for code you can actually put through the Cajoler. It's still a good, if imperfect, solution for other use-cases.
pixdamix 15y ago
You would be able to get past 2048bytes using mozilla or chromium See there: https://www.squarefree.com/bookmarklets/limits.html https://www.squarefree.com/bookmarklets/limits.html I just tested a 1Mb bookmarlet on chromium and it works.
- eran 15y ago
  Thank you for link, very interesting stats. FF also has reasonable URL limit. At least for some browsers I can do it.
dedward 15y ago
Don't do your self the disservice of self-signed - you can get a free cert from startssl. The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....) Just hit up startssl and get a real certificate... it's that easy. No strings attached. (Repeating this because I ignored it for about a year until actually checking it out and realizing I'd been an idiot) ALSO Given the single utility of this - just inline the scripts you need and avoid the request overhead. You can probably strip out all the functions you don't need to minimize the load time. You could offer a minimized version as well.... ALSO Very cool! Thanks!
- eran 15y ago
  Thank you for advice about cert service! Awesome. Will request SSL cert right now. I consciously left scripts uncompressed, so anybody can look what going on behind the scene. Also, I'll publish source code on github as soon as clean it up. Then I make compressed version.
- thwarted 15y ago
  The "other" reason to avoid a self signed cert is that a self signed cert still leaves your users open to a MITM attack. If your goal is to avoid a MITM, a self signed cert gives you nothing but more configuration lines in your webserver config.
- rorrr 15y ago
  It's only free for one year. It's a bait.

tptacek 15y ago

He'd also need to HTTPS all the scripts that script requires, and devise some way to ensure that the script was never called from a page that itself included any HTML or JS over a non-HTTPS connection, because any of those document loads could also MITM the script. Isn't Javascript crypto fun!

eran 15y ago

MITM issue fixed, all resources are loading over SSL