3 ms·

So? You guys wrote an article about it... http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/

So? You guys wrote an article about it... http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ "SJCL is great work, but you can't use it securely in a browser for all the reasons we've given in this document. SJCL is also practically the only example of a trustworthy crypto library written in Javascript, and it's extremely young. The authors of SJCL themselves say, "Unfortunately, this is not as great as in desktop applications because it is not feasible to completely protect against code injection, malicious servers and side-channel attacks." That last example is a killer: what they're really saying is, "we don't know enough about Javascript runtimes to know whether we can securely host cryptography on them". Again, that's painful-but-tolerable in a server-side application, where you can always call out to native code as a workaround. It's death to a browser."

tptacek 13y ago
I'm lost. What are you trying to say here?
- doe88 13y ago
  I think what is trying to say, is: let peoples learn by their mistakes. I really don't understand your focus on making a kind of witch hunt anytime someone try to learn and implement crypto. It is certainly the responsability of the developer to try not making mistakes but it's also the responsability of the user to know what to expect of what he is going to use. And I think most people on HN are smart enough to consider this kind of post with a grain of salt and not expect too much of it.
  - tptacek 13y ago
    It's starting to piss me off when people say I'm on a witch hunt for people learning crypto. I'm obviously not; I'm in the middle of dealing with literally hundreds of 1-1 conversations with strangers to help them learn crypto: http://www.matasano.com/articles/crypto-challenges/ http://www.matasano.com/articles/crypto-challenges/ My problem is with people who don't want to learn crypto, but do want to use it anyways.
  - elithrar 13y ago
    > I really don't understand your focus on making a kind of witch hunt anytime someone try to learn and implement crypto. There's a stark contrast between someone wanting to learn crypto (and being humble about the process) and someone who's new to crypto but being anything but humble.

tptacek 13y ago

I'm lost. What are you trying to say here?

doe88 13y ago
I think what is trying to say, is: let peoples learn by their mistakes. I really don't understand your focus on making a kind of witch hunt anytime someone try to learn and implement crypto. It is certainly the responsability of the developer to try not making mistakes but it's also the responsability of the user to know what to expect of what he is going to use. And I think most people on HN are smart enough to consider this kind of post with a grain of salt and not expect too much of it.
- tptacek 13y ago
  It's starting to piss me off when people say I'm on a witch hunt for people learning crypto. I'm obviously not; I'm in the middle of dealing with literally hundreds of 1-1 conversations with strangers to help them learn crypto: http://www.matasano.com/articles/crypto-challenges/ http://www.matasano.com/articles/crypto-challenges/ My problem is with people who don't want to learn crypto, but do want to use it anyways.
- elithrar 13y ago
  > I really don't understand your focus on making a kind of witch hunt anytime someone try to learn and implement crypto. There's a stark contrast between someone wanting to learn crypto (and being humble about the process) and someone who's new to crypto but being anything but humble.