News for hackers. Stuff that matters.
Re:Funds of every Trust Wallet browser extension could have ... by mrguyorama on Monday May 01, 2023 @02:06PM (#35776747)
This means that WASM is a garbage tool for this purpose and they should have gone a different route.
Re:Funds of every Trust Wallet browser extension could have ... by lxgr on Monday May 01, 2023 @02:23PM (#35776974)
No, you seem to be misunderstanding what WASM is and isn't. WASM is the specification of a bytecode format (i.e. something like a virtual ISA) and the corresponding execution environment.

It's perfectly possible to implement a secure PRNG in WASM and supply entropy/a seed as a parameter to that, and this is exactly what emscripten does. Trust just happened to provide a non-secure PRNG in their implementation (and ironically quotes emscripten's PR while doing the opposite).

They reimplemented low-level crypto primitives in an insecure way, and quite possibly without even realizing that they were doing so, and their users are paying the price. No language or framework can protect developers from that.