4 ms·
Seriously, the article is badly mistitled. > And if you have SSL, why do you need Javascript crypto? Just use the SSL. Maybe because SSL only solves one probl
by haberman 14y ago
Seriously, the article is badly mistitled.
> And if you have SSL, why do you need Javascript crypto? Just use the SSL.
Maybe because SSL only solves one problem, and other cryptographic algorithms/systems solve other problems?
- makomk 14y agoAlso, until recently SSL didn't support any kind of forward secrecy, and even now many SSL servers and clients aren't configured to use it. What this means is that if an attacker ever gets hold of an SSL server's old private key, they can decrypt any SSL sessions they've recorded which used that key. This makes security measures like JavaScript crypto which only protect against passive eavesdropping quite a bit more useful than you might naively expect.