How Turtl has no idea when you're sharing copyrighted stuff

Re:How Turtl has no idea when you're sharing copyrighted stuff by foobarqux on Sunday March 30, 2014 @08:11PM (#7498619)

The security model is broken. You can't securely do encryption in server side javascript.

[ Parent | on HN ]

Re:How Turtl has no idea when you're sharing copyrighted stuff by orthecreedence on Sunday March 30, 2014 @08:17PM (#7498645)

Incorrect, my friend! There's no server-side javascript. Turtl is a downloaded, self-contained app, and all encryption happens in that app.

[ Parent | on HN ]

Re:How Turtl has no idea when you're sharing copyrighted stuff by foobarqux on Sunday March 30, 2014 @10:39PM (#7499242)

Sorry, my mistake. I guess I just assume everything is a webapp these days.

[ Parent | on HN ]

Re:How Turtl has no idea when you're sharing copyrighted stuff by SomeoneWeird on Monday March 31, 2014 @03:45AM (#7500195)

May I ask why you think that is?

[ Parent | on HN ]

Re:How Turtl has no idea when you're sharing copyrighted stuff by orthecreedence on Monday March 31, 2014 @04:11AM (#7500268)

It's true you can't reliably do crypto in javascript served from a web server. The idea is that someone could hack into your server, replace `crypto.aes.js` with `crypto.plaintext.js` and suddenly your app is silently sending plaintext back to the server where ciphertext is expected.

The correct way is to create a (signed) package of your app so that it pulls in no external scripts or files. Makes updates a pain (no free auto-upgrades you get from the web) but makes the app a lot more difficult to attack.

[ Parent | on HN ]