4 ms·
> While Cryptocat is written in Javascript (aaggh!) Is there something inherently insecure about using JavaScript or is this not meant to actually be relevant?
by btipling 14y ago
> While Cryptocat is written in Javascript (aaggh!)
Is there something inherently insecure about using JavaScript or is this not meant to actually be relevant?
- krapp 14y agoThe problem with javascript encryption is the environment in which it runs being impossible to control... and also some features of the language. There's no strong random number generator, for instance. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/
- jacques_chester 14y agoIf it's served from a webpage, then it's insecure. Either the publishing server can replace it with a malicious version, or another server might inject javascript that modifies or replaces it with a malicious version. This particular point hilariously broke a crypto protocol project of mine, so I guess I'm touchy about it. Shipping as a browser module is more secure.
- btipling 14y agoThat's not really a problem with the language.
- jacques_chester 14y agoGiven that javascript is the language that can be embedded in any webpage ... yes it is.