3 ms·

> Do you have to trust the server a reasonable amount because of the fact that they could change their JS at any time? What if it's not the server's JS? - htt

• chrisfosterelli 12y ago
  Desktop crypto applications also suffer from security vulnerabilities, I think the same criticism applies there. Clever XSS by the way ;)
• jamiesonbecker 12y ago
  Agreed.. but XSS (or MITM injection) isn't a scalable activity. You'd have to write it custom for each app. Even if you just attacked the underlying library, it's still something that's detectable on the browser side, so you'd have to carefully target your opponent (unless you just didn't care if they knew at all -- but that'd minimize your effectiveness as well.) IMO, it's definitely worthwhile at least the initial crypto stage in-browser. Heartbleed et al proved that. Just don't rely on it. Ensure strong TLS, HSTS, etc as well. Definitely agreed - XSS is really severely problematic since it's potentially easier and doesn't require MITM. In this rare use case (and without actually trying the app), I'm guessing you'd basically have to be XSS'ing yourself since you're probably not XSS'ing a public field?