News for hackers. Stuff that matters.

A comment on End-to-end encryption in the browser. Parent comment

Re:End-to-end encryption in the browser by nwsm on Monday March 23, 2020 @01:34PM (#22666431)
All JS is executed in the browser. If the malicious site wanted to steal the data, it must send the key to the server.

With enough inspecting, debugging, and network watching you would be able to see what they're doing and how.

While I agree you can obfuscate this in the JS payload, it doesn't make e2e encryption in web apps "meaningless". It would just take one user doing some due diligence to expose the malice.

[ Parent | on HN ]
Re:End-to-end encryption in the browser by vbezhenar on Monday March 23, 2020 @01:39PM (#22666512)
It does not work this way if this attack is targeted on a very few users and it's trivial to serve a different scripts to a different users.
[ Parent | on HN ]