3 ms·
Please stop upvoting this article, it's misleading at best. It links to the article everyone should read on browser cryptography, the article that says exactly
by tinco 13y ago
Please stop upvoting this article, it's misleading at best. It links to the article everyone should read on browser cryptography, the article that says exactly why browser cryptography does not and basically never could work.
The article then picks the least important of all security problems, that there isn't (wasn't) a secure way of generating random numbers, acts as if that was an important point and then carries on as if browser cryptography has been solved.
In their about page they claim: "As a result, Opal is able to guarantee that the only people who are able to read a secret file are the sender and recipients."
This is plainly not true. The people who are able to read these secret files are always those who control the browser. They might claim that they're able to guarantee it because they control the code that is sent by the server, but recent history has shown us that if they were to be forced to break that guarantee, they would not be allowed to let anyone know.
So what is their guarantee worth to anyone? Jack shit.
- tptacek 13y agoPart of the problem is that the JS crypto article they linked to isn't very good, but has for some reason become emblematic of the whole argument against JS crypto. It deserves an update.