4 ms·

That's right. SubtleCrypto implementations are also fast, and available on mobile browsers. SubtleCrypto has some design choices to avoid common mistakes to red

by Jiocus 5y ago

That's right. SubtleCrypto implementations are also fast, and available on mobile browsers. SubtleCrypto has some design choices to avoid common mistakes to reduce risk of vulnerable implementations[1], and as such it's aimed at the general developer. In my opinion, more developers should familiarize themselves with the tools and start looking at how they could implement security for their users. Processing highly critical data, such as PII or financial data, is not a requirement to use cryptography. Starting out, on could well be served by trying it in personal projects or even public data. This way, uncovering a vulnerable design could mean uncovering data that was already meant to be seen. Some will always argue it's the wrong or the dangerous thing to do, and they will never ship security to their users, I guess. – [1]: For example, the ReactDOM manipulations breaks this security model because SubtleCrypto will only interface with the DOM. There are additional libs as workarounds for these issues tho.

bawolff 5y ago
> and as such it's aimed at the general developer. Its literally named subtle to discourage the general developer. In the https web model, there are very few situations where using this api actually makes sense. (Seriously, i challenge you to name one in a typical server-client web app)
- Jiocus 5y ago
  > Its literally named subtle to discourage the general developer. “It is named SubtleCrypto to reflect the fact that many of these algorithms have subtle usage requirements in order to provide the required algorithmic security guarantees.”[1] This was the closest to an explicit mention of the name I could find right now. It could read both as ‘the api provide security guarantees’ or ‘the developer provides security guarantees’. The article goes on to mention the customary warnings for developers about to do dangerous things. So yes, I believe you are right on this one. My memory served me otherwise. I still think developers would do themselves and their users a service by learning about applied cryptography and how to securely implement it. > In the https web model, there are very few situations where using this api actually makes sense. (Seriously, i challenge you to name one in a typical server-client web app) There are no situations where using this api without HTTPS is even possible. SubtleCrypto is only available in secure context. Making an argument that the api then doesn't make sense in said secure context doesn't resonate with the design choices behind it. About server-client apps, client-side cryptographic schemes are a thing. I access my encrypted cloud storage provider right now which implements client-side crypto. So are end-to-end cryptography, e.g. two users messaging each other througn a common server. These use-cases are not covered by HTTPS as we know. Here's a link to some part of Matrix[2] that seem to use this api, but don't take my word for it. – [1]: https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface [2]: https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes.js.html https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes....

by Jiocus 5y ago

bawolff 5y ago

> and as such it's aimed at the general developer. Its literally named subtle to discourage the general developer. In the https web model, there are very few situations where using this api actually makes sense. (Seriously, i challenge you to name one in a typical server-client web app)

Jiocus 5y ago
> Its literally named subtle to discourage the general developer. “It is named SubtleCrypto to reflect the fact that many of these algorithms have subtle usage requirements in order to provide the required algorithmic security guarantees.”[1] This was the closest to an explicit mention of the name I could find right now. It could read both as ‘the api provide security guarantees’ or ‘the developer provides security guarantees’. The article goes on to mention the customary warnings for developers about to do dangerous things. So yes, I believe you are right on this one. My memory served me otherwise. I still think developers would do themselves and their users a service by learning about applied cryptography and how to securely implement it. > In the https web model, there are very few situations where using this api actually makes sense. (Seriously, i challenge you to name one in a typical server-client web app) There are no situations where using this api without HTTPS is even possible. SubtleCrypto is only available in secure context. Making an argument that the api then doesn't make sense in said secure context doesn't resonate with the design choices behind it. About server-client apps, client-side cryptographic schemes are a thing. I access my encrypted cloud storage provider right now which implements client-side crypto. So are end-to-end cryptography, e.g. two users messaging each other througn a common server. These use-cases are not covered by HTTPS as we know. Here's a link to some part of Matrix[2] that seem to use this api, but don't take my word for it. – [1]: https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface [2]: https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes.js.html https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes....