5 ms·
As long as server can serve any JS to any client, you can’t protect the data from the server.
by vbezhenar 6y ago
As long as server can serve any JS to any client, you can’t protect the data from the server.
- metafunctor 6y agoHow is that? Lots of sites server their code to any client, but the data contained within the service is still secure.
- q3k 6y ago'Javascript crypgography considered harmful' by tptacek (2011): https://archive.is/cyk2R https://archive.is/cyk2R tl;dr: In most cases browser JS crypto offers no advantages if you're trying to protect yourself from a rogue/compromised backend (eg. do e2e crypto on keys stored within localstorage before passing that over to the backend). That is because if the backend is compromised it can likely serve backdoored JS code that will leak secrets. This is not always true (eg. if you have multiple tiers of server backends within separate security domains), but almost always true for typical web monoliths.
- austincheney 6y agoIt’s more complicated than that. For the most part the browser is a secure environment due to same origin policy. JavaScript in the browser can only send and receive from the domain from which that JavaScript is served, which means the JavaScript must come from your own domain or from a third party you trust. That trust is all from the perspective of the web server, though, which is orthogonal to the concerns of the end user. https://en.m.wikipedia.org/wiki/Same-origin_policy https://en.m.wikipedia.org/wiki/Same-origin_policy Browser extensions can bypass that though, which can expose you to malicious third parties.
- tyingq 6y ago"Third party you trust" is tricky though. Like what happened with Backblaze. I don't think they really intended to scarf private data and exfiltrate it. Probably just a marketing person not knowing the implications. https://news.ycombinator.com/item?id=26536019 https://news.ycombinator.com/item?id=26536019