2 ms·
The "secure unless" list needs to include: * Author of page is malicious. * Operator of server is malicious. * Anyone with access to the network between you
by nullc 12y ago
The "secure unless" list needs to include:
* Author of page is malicious.
* Operator of server is malicious.
* Anyone with access to the network between you and the server is malicious. (no HTTPS)
* Google or anyone who has compromised their infrastructure is malicious (has embedded google js on the page).
* Likewise for 'bootstrapcdn', 'jquery.com', or cloudflare.
OTOH, it uses window.crypto and doesn't silently fall back to insecure randomness like 95% of JS crypto that I've looked at...
:)
- jbclements 12y agoUm... certificate pinning? Fortunately, my last caveat covers a bunch of these. Also, I think you(I) forgot: * You are in fact hallucinating at this very moment.
- nullc 12y ago:) Cert pinning does nothing when the page is plain http as it is here. (and HTTPS's helpfulness is limited without HSTS; were it HTTPS I'd have a couple of other assumptions like none of the hundreds of CAs are malicious, and "no attacker is able to MITM between the site and any CA that does domain-validation.) I didn't run off that list to criticize the site. The last bullet is indeed good. :)