Re:Megafail
by anonymouz on Wednesday January 23, 2013 @04:29AM
(#5102257)
More fundamentally then the reasons others have already stated is that the JavaScript is loaded from a server anyway. So you trust the server anyway, and hence may as well just do the encryption on the server.
[ Parent
| on HN ]
Yes. This is also why assurances that XSS bugs have been fixed aren't comforting. The problem isn't simply that attackers will find ways to corrupt the JS crypto code; the problem is that it is extremely difficult for end-users to verify that the crypto code they're running isn't bugged.