Cryptico.js - strong encryption system utilizing RSA and AES for javascript

Re:Cryptico.js - strong encryption system utilizing RSA and ... by cipherpunk on Sunday August 28, 2011 @02:06PM (#2934524)

But of course. Preaching to the choir.

Management made the decision that my trivial change to eliminate replay attacks was "too much effort". I am inclined to agree, since even with such a change the effort required to circumvent their entire so-called security is minimal.

Next quarter they're introducing e-commerce solutions. Dear god.

[ Parent | on HN ]

Re:Cryptico.js - strong encryption system utilizing RSA and ... by nitrogen on Sunday August 28, 2011 @04:22PM (#2934837)

One might argue that, if an unnamed company's e-commerce solution would put a lot of people at risk, and an unnamed engineer can prove it, that unnamed engineer has an ethical obligation to discreetly report the vulnerability first to the unnamed company, then to successively more influential and more public venues (e.g. consumer protection groups, security research groups, etc.), until the company responds.

[ Parent | on HN ]

Re:Cryptico.js - strong encryption system utilizing RSA and ... by tptacek on Sunday August 28, 2011 @04:43PM (#2934910)

One might argue that such a course of action will simply get the engineer pointlessly fired.

[ Parent | on HN ]