Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's right. If you have no HTTPS, I can strip the JS/WASM that does encryption and fetch your cleartext password when you POST it back.

If there is HTTPS I cannot strip the JS/WASM that does crypto... but you don't need user-side crypto any more.



There might be situations when you want client-side crypto not for sending data over the network, but to securely encrypt a document that you want to send / use in a different context. Using an emscripten-compiled crypto library would allow you to do this in your browser without sending any of the data over the wire.


Alright, but everything can still be tampered. At best, you can cause a denial of service, at worst modify a document that a user signs has its own.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: