3 ms·
> or you trust them to send you JavaScript that does the encryption in the browser I don't need to give trust in that case, as I could verify the encryption my
by Deestan 13y ago
> or you trust them to send you JavaScript that does the encryption in the browser
I don't need to give trust in that case, as I could verify the encryption myself.
- nwh 13y agoYou won't though.
- DerpDerpDerp 13y agoI doubt that most users of a service are in any position to audit complex crypto code.
- Deestan 13y agoThat doesn't really matter, because they don't need to. All it takes is one crypto-savvy person taking an interest and finding a fault, then posting about it. Even if they do actively cheat and provide some obscure not-really crypto to give an impression of security, they need to put in an effort, whereas with serverside encryption they could cheat for free. There is also a constant risk of some techie discovering their lack of security. Anyway, it doesn't matter if you consider auditable security imperfect. Auditable security is objectively more trustworthy than non-auditable security.
- foobarqux 13y agoevery time you use the app.