4 ms·
How is AES ECB even possible? You would have to actively choose to do that. It's more effort than something like libsodium. Have they not heard of the first r
by eternityforest 4y ago
How is AES ECB even possible? You would have to actively choose to do that. It's more effort than something like libsodium.
Have they not heard of the first rule of crypto being "You probably aren't qualified to do it, use libsodium or TLS or SSH" yet? Why are they messing with cipher modes themselves?
- tptacek 4y agoTheir encryption code predates libsodium, and ECB was (on many platforms still is) the default mode --- also, the only mode that doesn't require confusing extra parameters.
- eternityforest 4y agoIt's an utterly useless mode though unless you add your own confusing extra stuff. It was probably a bad plan to make that the default.
- insanitybit 4y agoPeople forget that: a) LastPass is extremely old b) Browser extensions used to be completely different. You needed to call out to native code to do tons of stuff because the JS apis were extremely limited and slow. So it was either "roll crypto in JS" or "make users install a binary", the latter stopped being possible over something like a decade ago.