News for hackers. Stuff that matters.

A comment on Show HN: aes.io - secure storage/collaboration with client-side JS crypto. Parent comment

Re:Show HN: aes.io - secure storage/collaboration with clien... by Piskvorrr on Friday July 20, 2012 @10:33AM (#4270957)
In other words, "I don't understand #2, so let's assume it's not a problem and handwave it away." Alas, it is a problem, and a critical one. Pray tell, how do you check the VM, from inside the VM sandbox? Guess what: you have no way to do that, not in JavaScript. That's another chicken-and-egg problem which is insurmountable with client-side, in-page JS.
[ Parent | on HN ]
Re:Show HN: aes.io - secure storage/collaboration with clien... by trekkin on Friday July 20, 2012 @10:40AM (#4270992)
I cannot do that from inside the sandbox, but as I completely control the page, not just one script on it, I can be reasonably sure no rogue script is running on it (by using SSL).

I've read the Matasano article, don't assume I didn't. Most of the points in it are negated by controlling the page 100% and using SSL.

[ Parent | on HN ]
Re:Show HN: aes.io - secure storage/collaboration with clien... by tptacek on Friday July 20, 2012 @11:11AM (#4271127)
I'm confused. In way does your application protect users against you? You control the code that handles the users encryption secrets. Your users have no effective way to police you.

Why not just have the users send you their plaintext, and rely on SSL/TLS for the rest of your security? It seems like that provides effectively the same security.

[ Parent | on HN ]