-
Notifications
You must be signed in to change notification settings - Fork 0
Home
One of the issues with developing SecureBin was navigating how to achieve our goal of security without compromising the system with a poor implementation. This led us like most software engineers to Stack Overflow which was filled with conflicting opinions on the usefulness of JavaScript Cryptography.
There are two competing trains of thought on JavaScript cryptography. It is either useless or provides another way to tackle security.
The main argument against is how to ensure that the JavaScript code being used is not modified in transit via a man-in-the-middle attack. In fact, a malicious actor would only need to insert a <Script> tag in order to compromise the security of the system [1]. Other arguments focus on a lack of native primitives for cryptography, although that is no longer the case with the development of Web Crypto [2].
While Java Script Cryptographic will not provide security if the network or server is compromised, it does provide security for local services like extensions which do not need to worry about man-in-the-middle attacks [3].
To mitigate the issue of JS transmission we developed SecureBin as a local extension that uses open-source cryptography libraries to encrypt user data locally. SecureBin is open source and can be examined by anyone to validate the security of the system.
SecureBin is a Google Chrome Extension that interfaces with PasteBin, a popular web-based clipboard. Users can type in text and have it automatically encrypted using an algorithm of their choice. Users can gain access to the ciphertext on another device by providing a decryption key and a PasteBin URL, which will then decrypt the plaintext to the user. In addition to typing text, a user can also choose to encrypt text locally by selecting it on their page and right-clicking.
[1] https://web.archive.org/web/20160305004110/https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/
[2] https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
[3] https://vnhacker.blogspot.com/2014/06/why-javascript-crypto-is-useful.html
[4] https://rdist.root.org/2014/06/23/in-defense-of-javascript-crypto/
[5] https://developer.ibm.com/articles/secure-javascript-applications-with-web-crypto-api/