2 ms·
How is that? Lots of sites server their code to any client, but the data contained within the service is still secure.
by metafunctor 5y ago
How is that? Lots of sites server their code to any client, but the data contained within the service is still secure.
- q3k 5y ago'Javascript crypgography considered harmful' by tptacek (2011): https://archive.is/cyk2R https://archive.is/cyk2R tl;dr: In most cases browser JS crypto offers no advantages if you're trying to protect yourself from a rogue/compromised backend (eg. do e2e crypto on keys stored within localstorage before passing that over to the backend). That is because if the backend is compromised it can likely serve backdoored JS code that will leak secrets. This is not always true (eg. if you have multiple tiers of server backends within separate security domains), but almost always true for typical web monoliths.