4 ms·

If anybody uses this, please keep in mind the differences in security possibilities between native C code and Javascript. Both this and GnuPG encrypt and decry

by mrmekon 13y ago

If anybody uses this, please keep in mind the differences in security possibilities between native C code and Javascript. Both this and GnuPG encrypt and decrypt data with PGP keys. GnuPG, however, does this securely, in many, many senses of the word. For instance, GnuPG maps all of its buffers to protected memory pages, and clears its buffers frequently and early. A very large portion of GnuPG's code is dedicated to protecting your private keys, and the techniques that they use simply aren't available to javascript. This doesn't mean the JS library is bad, it's just a good thing to keep in mind. Don't run your nuclear launch codes through this.

sensibletouches 13y ago
> Don't run your nuclear launch codes through this. Just keep them in your coat pocket: http://news.bbc.co.uk/2/hi/americas/328442.stm http://news.bbc.co.uk/2/hi/americas/328442.stm
aragot 13y ago
Thank you for saying it. I find it dangerous to let users believe their data is secure, when the in-js encryption is everything but. It may lead to all sorts of misunderstandings and litigation issues...
oconnore 13y ago
https://github.com/eschulte/node-gpg https://github.com/eschulte/node-gpg (a Javascript PGP library that might be safe for nuclear launch codes)
- mrmekon 13y ago
  This is not a PGP library. It's a wrapper around gpgme, which in turn is a wrapper around gnupg. node-gpg just exposes the GnuPG command line as javascript functions.
  - oconnore 13y ago
    And nodejs is not a javascript server, it's just a wrapper around V8 and the kernel's socket API? Linux is not an operating system kernel, it's just a wrapper around X86? That distinction is silly.
    - mrmekon 13y ago
      Nothing is anything. We're all just subatomic particles destined for heat death But, really: openpgpjs, the topic of the article, is a program that implements the OpenPGP standard, and the cryptographic algorithms it depends on. node-gpg, the topic of this comment, does not implement any part of the OpenPGP standard, nor any cryptographic algorithms. It executes a local C program, GnuPG. If you don't have that C program, it does nothing. Suggesting that they are the same thing is silly. The distinction is massive. Otherwise, I could claim I just implemented a world-class PGP implementation! To try it out, just run: perl -e "exec 'gpg'"

by mrmekon 13y ago

sensibletouches 13y ago

> Don't run your nuclear launch codes through this. Just keep them in your coat pocket: http://news.bbc.co.uk/2/hi/americas/328442.stm http://news.bbc.co.uk/2/hi/americas/328442.stm

aragot 13y ago

Thank you for saying it. I find it dangerous to let users believe their data is secure, when the in-js encryption is everything but. It may lead to all sorts of misunderstandings and litigation issues...

oconnore 13y ago

https://github.com/eschulte/node-gpg https://github.com/eschulte/node-gpg (a Javascript PGP library that might be safe for nuclear launch codes)

mrmekon 13y ago
This is not a PGP library. It's a wrapper around gpgme, which in turn is a wrapper around gnupg. node-gpg just exposes the GnuPG command line as javascript functions.
- oconnore 13y ago
  And nodejs is not a javascript server, it's just a wrapper around V8 and the kernel's socket API? Linux is not an operating system kernel, it's just a wrapper around X86? That distinction is silly.
  - mrmekon 13y ago
    Nothing is anything. We're all just subatomic particles destined for heat death But, really: openpgpjs, the topic of the article, is a program that implements the OpenPGP standard, and the cryptographic algorithms it depends on. node-gpg, the topic of this comment, does not implement any part of the OpenPGP standard, nor any cryptographic algorithms. It executes a local C program, GnuPG. If you don't have that C program, it does nothing. Suggesting that they are the same thing is silly. The distinction is massive. Otherwise, I could claim I just implemented a world-class PGP implementation! To try it out, just run: perl -e "exec 'gpg'"