5 ms·
SSL/TLS doesn't solve this problem noted by GP: Furthermore, and most importantly, by using SSL/TLS, the data being sent by the browser to the server is encryp
by lawnchair_larry 15y ago
SSL/TLS doesn't solve this problem noted by GP:
Furthermore, and most importantly, by using SSL/TLS, the data being sent by the browser to the server is encrypted as it passes through the network, but however remains readable by the server when it reaches it. Whereas with client-side JS crypto, the server cannot read the sensitive data.
This is a shortcoming in the argument made in the article, because it wrongly assumes that we would always want the server to decrypt our data.
I am not saying JS does solve this, but SSL doesn't, and it isn't even meant for that use case.
- jbri 15y agoIn fact, any "solution" that relies on the server giving you code to prevent the server from reading your data is inherently broken.
- magikarp 15y agoI disagree, on the grounds that the code can always be verified.
- jbri 15y agoBy whom? Do you trust them? If so, why not have them do the encryption rather than relying on untrusted code to do it?
- fadzlan 15y agoVerified can mean a lot of things. It can mean it comes from a source your trust. Or it can mean you trust it to do something that you know and only that. Which one do you refer? The only way to verify behavior of codes is to do source auditing yourself. Which is what our average Joes would not be able to do himself anyway, so you get back having to trust entities instead of behavior. Which in that case, we are either get back to CAs or trusting individual certs directly.