News for hackers. Stuff that matters.
Re:FileKit: An open source end-to-end encrypted cloud storag... by javajosh on Thursday August 29, 2019 @06:22PM (#20834300)
the central flaw of browser javascript cryptography, which is that to use it, you have to continuously and durably trust the server

What do you think of doing JavaScript Crypto in a browser extension? An extension runs code in the browser without persistent trust of a server (at least in the traditional webapp way; you have to persistently trust the extension update server, extension authors, chrome update server, etc). You could do things like quickly, interactively encrypt chunks of text with a symmetric key. Presumably you'd use an extension UI to enter your keys, to avoid keylogging.

I think it would be illuminating to have a small suite of well-implemented cryptographic primitives, curated by a well-known expert, installed and ready to use on any string in the browser.

(BTW why don't we see more random chunks of cyphertext everywhere? It would seem to me a good channel, to use a combination of public forums to transfer short bursts of cyphertext. Where are the encrypted Twitter broadcasts??)

Re:FileKit: An open source end-to-end encrypted cloud storag... by tptacek on Thursday August 29, 2019 @08:45PM (#20835042)
I don't love browser extensions but the trust model issues with it are not identical to content-controlled Javascript.
Re:FileKit: An open source end-to-end encrypted cloud storag... by tipiak on Friday August 30, 2019 @04:21AM (#20836740)
The issue with browser extensions, is that you are not far away from the common hurdles of developing, using and releasing a "real" desktop/mobile application. Having nothing to install and landing on a page that just works, is a big plus for you users.