Re:Tanker: End-to-End Encryption SDK for JavaScript
by jand on Wednesday May 22, 2019 @11:53AM
(#19982495)
> I keep asking, what is the threat model for end-to-end encryption in JS?
Even if there were no specific attack vector guarded by client side encryption, others reasons for JS-/client-side encryption may exists.
I could imagine some legal reasoning like 'The data was already encrypted when the client stored it on our servers, we had not knowledge of the illicit content.'.
For a share-hoster that alone might be reason enough to feel the need for JS-/client-side encryption.
Even if there were no specific attack vector guarded by client side encryption, others reasons for JS-/client-side encryption may exists.
I could imagine some legal reasoning like 'The data was already encrypted when the client stored it on our servers, we had not knowledge of the illicit content.'.
For a share-hoster that alone might be reason enough to feel the need for JS-/client-side encryption.
Is that too far fetched?