3 ms·
How exactly can he do that when all the traffic is encrypted via SSL? And to address the quote from the article that you don't need JS Crypto if you're using S
by M4v3R 12y ago
How exactly can he do that when all the traffic is encrypted via SSL?
And to address the quote from the article that you don't need JS Crypto if you're using SSL/TLS. It's a wrong assumption, there are still uses for it. It adds more security to the user data which is encrypted before it hits the server. A hacker owning the server at some point won't be able to get the data. He could, in theory, plant a exploit to collect user passwords (as they log in) but it's unlikely that it wouldn't get noticed very quickly.
- Tloewald 12y agoI think the problem is when using JavaScript crypto instead of TLS, not in addition to. The article should probably address this specifically.
- lloeki 12y agoNot just: any attack that can inject arbitrary code in a web page (e.g XSS attacks), and other crypto oriented attack due to lack of serious primitives being available (e.g timing attacks or attacks on the RNG)
- Tloewald 12y agoSure but I'm not clear on how this would be made worse by in-browser crypto.
- deleted 12y ago[deleted]