> Would you trust it more if it required JavaScript instead of Java? > Why or why not? A couple of months ago I started working on a contact form using OpenPGP

> Would you trust it more if it required JavaScript instead of Java? > Why or why not? A couple of months ago I started working on a contact form using OpenPGP.js[1]. The idea was that by having the content in javascript it wouldn't need third-party plugins and would send encrypted e-mails to an unknown address. Ideal for something like a drop box or simply to ensure that your granny can securely contact you without understanding encryption. After considerable thought and evaluation I decided against publishing it rather than risk people adopting a solution I felt that ultimately I couldn't appropriately secure. Fundamentally the biggest problems with Javascript cryptography (as far as I can tell, and I'm not a cryptographer, I'm a security specialist) are (in no particular order): * Differences between implementations in different browsers, different Operating Systems, the same browser on different Operating Systems etc. * Sources of randomness across different platforms * Getting the Javascript to the user securely in a trustworthy manner * Caching (which can be both good and bad depending on whether the point above has been resolved) These are just a few of the problems without even getting to the horrible stuff like bugs in JS implementations that could either affect crypto safety or result in exploitable conditions compromising either data or the client system. Java on the other hand is fairly standard across systems (to a point, but a point that can be largely controlled by the applet) and has some fairly robust crypto interfaces and 3rd-party components. That trust issue about getting the code to the target securely is still the same. [1] - http://openpgpjs.org/ http://openpgpjs.org/