3 ms·
This is where you lose me: "...I'd figure that if they were injecting JS to steal my password, or subtly poison my RNG, and if they were doing that to everyone
by graue 13y ago
This is where you lose me:
"...I'd figure that if they were injecting JS to steal my password, or subtly poison my RNG, and if they were doing that to everyone..."
To everyone — maybe that would get found out, maybe it wouldn't. But it doesn't have to be done to everyone. That backdoor in the JS could be served to only you. Maybe only certain times of day. How are you going to know?
- visarga 13y agoWe are all open to that. Google, MS and Apple send us software updates that have root privileges on our computers. They hold the keys to our digital houses. We allow them to enter and fix our plumbing and electrical wiring almost every week, and rarely can see or understand what they "fixed". We are with our pants down.
- masonlee 13y agoAnd it's pants all the way down! Can we even trust our chips? But we stagger on.
- feral 13y agoIf its targeted just at you, its a different class of attack. Of course, no technology can protect against all classes of attack. I'm just saying that there are situations where JS crypto might be useful, such as increasing the difficulty of conducting mass surveillance in secret. Secret mass surveillance being, of course, a big topic recently. What people need is not security that defends perfectly against every threat in theory, but no one uses in practice.