Re:Cryptography in the Browser
by tptacek on Tuesday October 29, 2013 @09:09PM
(#6638767)
This is like saying a sign that says "attackers keep out" provides real security, as long as you keep in mind that it only works if attackers obey the sign. After all, Dropbox doesn't have an "attackers keep out" sign!
[ Parent
| on HN ]
It is a little better than that. What about an enterprise application where you have control/trust of the server, but want to securely cache data in offline browser storage.
That covers common scenarios, like people who provide web based access to Microsoft Exchange.
No, it's more like an imperfect lock is still more security than no lock at all on your door.
No, it's more like people thinking they have a high grade lock on their door, when in fact they have a broken lock. They can't see it's broken, but anyone who knows about locks knows it's broken, and how to bypass it with a bobby pin.
Is this supposed to be serious, because we want javascript to be better, or sarcastic, because most people DO live behind locks that are broken and can be bypassed trivially with relatively unsophisticated tools? Everybody break out your bobby pins!