News for hackers. Stuff that matters.

A comment on Show HN: Deadrop.us. Parent comment

Re:Show HN: Deadrop.us by sneak on Thursday May 24, 2012 @04:23AM (#4017400)
> But they admit that if you can secure the transmission of the entire contents of the page (HTML, JS, everything), then your JS crypto should be OK

Nope. The server operator can still serve you (perfectly secured over an SSL channel) backdoored javascript crypto code.

[ Parent | on HN ]
Re:Show HN: Deadrop.us by jeduga on Thursday May 24, 2012 @08:44AM (#4018068)
Which can be clearly viewed by the community.
[ Parent | on HN ]
Re:Show HN: Deadrop.us by sneak on Friday May 25, 2012 @06:39AM (#4022900)
Only for that point-in-time. Nothing stopping it from serving backdoored JS _just to your IP_, or _just for five minutes that one time_. Dynamic web app, remember? :)
[ Parent | on HN ]