4 ms·
My crypto knowledge is not really up to snuff but doesn't this not use any real end-to-end crypto when it easily could? SSL, AES, and blowfish could all be MITM
by jabgrabdthrow 13y ago
My crypto knowledge is not really up to snuff but doesn't this not use any real end-to-end crypto when it easily could? SSL, AES, and blowfish could all be MITM'd, right?
- spikels 13y agoI'm not sure how much better you can do with a webapp. Either you trust them to encrypt your messages on the server or you trust them to send you JavaScript that does the encryption in the browser. Either way you need to trust the app provider. SSL should ensure it is not MITMed before it gets to their server.
- phaer 13y agoIn this case a SSL certificate which is certified by 'GoDaddy.com, Inc.'. Not too trustworthy if you ask me.
- Deestan 13y ago> or you trust them to send you JavaScript that does the encryption in the browser I don't need to give trust in that case, as I could verify the encryption myself.
- nwh 13y agoYou won't though.
- DerpDerpDerp 13y agoI doubt that most users of a service are in any position to audit complex crypto code.
- Deestan 13y agoThat doesn't really matter, because they don't need to. All it takes is one crypto-savvy person taking an interest and finding a fault, then posting about it. Even if they do actively cheat and provide some obscure not-really crypto to give an impression of security, they need to put in an effort, whereas with serverside encryption they could cheat for free. There is also a constant risk of some techie discovering their lack of security. Anyway, it doesn't matter if you consider auditable security imperfect. Auditable security is objectively more trustworthy than non-auditable security.
- foobarqux 13y agoevery time you use the app.