3 ms·
WOW, makes you wonder. Digitaly signed and hashed javascript verification certianly has a market it seems.
by Zenst 14y ago
WOW, makes you wonder. Digitaly signed and hashed javascript verification certianly has a market it seems.
- __alexs 14y agoUseless when the company you are getting the signed program from is serving you a malicious package on purpose which appears to be what happened here.
- eli 14y agoUh, I guess. Why bother using javascript at all if you need some non-javascript tool to verify it everytime you use it? Might as well just use GPG along with any existing mail service.
- stinkytaco 14y agoOne thought is that you can get PGP functionality from a portable service. If you brought the javascript with you on a USB drive, you could use it from computers that were not your own. Of course you could also install Thunderbird portable on your USB drive and implement your suggestion as well.
- molo 14y agoWhy would you ever put your private key within reach of a computer that is not your own?
- stinkytaco 14y agoTravel, work, government exile in hiding. Lots of reasons. If encryption is ever to become widespread, it needs to accomodate the myriad of situations that users might need computing/communication in. Which is a lot.
- ajdecon 14y agoI've seen this implemented (in a very special case) with statically-linked GPG on a USB drive and a Crypto Stick[1]. Better than JavaScript (because you don't need to rely on an untrustworthy interpreter), and the keys never leave the smart card. The big limitation is that you need admin access to the system if you need to install drivers for the smart card. [1] http://www.crypto-stick.com/ http://www.crypto-stick.com/