> Its literally named subtle to discourage the general developer. “It is named SubtleCrypto to reflect the fact that many of these algorithms have subtle usage

> Its literally named subtle to discourage the general developer. “It is named SubtleCrypto to reflect the fact that many of these algorithms have subtle usage requirements in order to provide the required algorithmic security guarantees.”[1] This was the closest to an explicit mention of the name I could find right now. It could read both as ‘the api provide security guarantees’ or ‘the developer provides security guarantees’. The article goes on to mention the customary warnings for developers about to do dangerous things. So yes, I believe you are right on this one. My memory served me otherwise. I still think developers would do themselves and their users a service by learning about applied cryptography and how to securely implement it. > In the https web model, there are very few situations where using this api actually makes sense. (Seriously, i challenge you to name one in a typical server-client web app) There are no situations where using this api without HTTPS is even possible. SubtleCrypto is only available in secure context. Making an argument that the api then doesn't make sense in said secure context doesn't resonate with the design choices behind it. About server-client apps, client-side cryptographic schemes are a thing. I access my encrypted cloud storage provider right now which implements client-side crypto. So are end-to-end cryptography, e.g. two users messaging each other througn a common server. These use-cases are not covered by HTTPS as we know. Here's a link to some part of Matrix[2] that seem to use this api, but don't take my word for it. – [1]: https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface [2]: https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes.js.html https://matrix-org.github.io/matrix-js-sdk/8.1.0/crypto_aes....