-
Notifications
You must be signed in to change notification settings - Fork 0
Home
One of the issue with developing secureBin was navigating how to achive our goal of security without compromising the system with a poor implementation. This led us like most software engineers to stack overflow which was filled with conflicting opinions on the userfullness of JavaScript Cryptography.
There are two competing trains of thought on Javascript cryptography. It either usless or it provides another way to tackle security.
The main argeument against is how to ensure that the javascript code being used is not modified in transit via a man in the middle attack. In fact, a malicious actor would only need to insert a <Script> tag in order to compromise the security of the system [1]. Another arguments focus on a lack of native primitives for cryptography, although that is no longer the case with the development of Web Crypto [2].
While Java Script Cryptographic will not provide security if the network or server is compromised, it does provide security for local services like extensions which do not need to worry about man in the middle attacks [3].
To midigate the issue of JS transmission we developed secureBin as a local extentions which uses open source cryptography libaries to entcrypt user data locally. SecurBin is open source and can be examined by anyone to validate the security of the system.
[1] https://web.archive.org/web/20160305004110/https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/
[2] https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
[3] https://vnhacker.blogspot.com/2014/06/why-javascript-crypto-is-useful.html
[4] https://rdist.root.org/2014/06/23/in-defense-of-javascript-crypto/
[5] https://developer.ibm.com/articles/secure-javascript-applications-with-web-crypto-api/