Tanker: End-to-End Encryption SDK for JavaScript

Re:Tanker: End-to-End Encryption SDK for JavaScript by nullwasamistake on Wednesday May 22, 2019 @04:57PM (#19985411)

E2E encryption in JS in browser will never be secure. In a client with shared threads and untrusted content on the page it will always be vulnerable to timing attacks. It's unrealistic to create a constant-time implementation in JavaScript.

For node/backend this is great but please don't use it on a public site.

[ Parent | on HN ]

Re:Tanker: End-to-End Encryption SDK for JavaScript by y96V89C668e7Q74 on Wednesday May 22, 2019 @05:32PM (#19985765)

Genuine question - is this what you're referring to? Very curious.

https://www.usenix.org/system/files/conference/usenixsecurit...

[ Parent | on HN ]

Re:Tanker: End-to-End Encryption SDK for JavaScript by nullwasamistake on Thursday May 23, 2019 @05:48PM (#19996360)

Hadn't heard of it actually, but side channels have been an issue in browser security for a long time.

Spectre caused a lot of changes in JS like disabling high precision clocks. But I'm afraid clock proxies are everywhere. The API surface is gigantic and all you need is a single call that reliably executes in constant time on the samr thread

[ Parent | on HN ]