While I have your attention, could you take a look at this: http://substack.net/offline_decentralized_single_sign_on_in_...
BTW, there's enough of us idiots out there that we're not going to stop until we've figured this out! Being able to ship a decentralized version of say Facebook or Twitter that runs in the browser and allows people to manage their own private keys (aka, manage their own digital identity) is incredibly motivating. I don't trust platforms like iOS or Android to not shut down certain kinds of apps and I don't think my mother will ever be running an open-source OS on her tablet.
I have to say that I definitely lost my shit in this thread... and I'm sorry. I have a tendency to get emotional about this kind of stuff because the politics are a big part of what motivates me to build these kinds of things. I take these hard-lined stances against browser javascript as an assault on my principles for digital identity but also as a creative individual who strives for a positive and constructive environment.
That doesn't justify me calling people names. Especially if I'm going to be talking about the means not justifying the ends... ugh...
However, I do think that articles like this are very close to being out of date: http://matasano.com/articles/javascript-cryptography/
The Web Crypto API alleviates a number of these issues and novel uses of application caching manifests seem to solve the issue for good.
Check out this article, especially Gotcha #4. http://alistapart.com/article/application-cache-is-a-doucheb...
So in this case we've got an authoritative article that says "never ever far-future cache the manifest". And we've got an authoritative article that says "never ever do crypto in the browser".
Both articles take a pretty heavy handed approach and don't really set out to explore the deeper possibilities. They both kind of set out to create an environment where readers will also not question these principles for fear of being made look like a fool in front of their peers.
But the fundamental hacker ethos is to read articles like this and say "the intent of the APIs and authors be damned, I have other considerations!".
Anyways, I'd really appreciate your thoughts on this stuff... all of, including what I and a number of other people perceive as a toxic environment for creativity related to cryptography and infosec.
One place I have put my own time in is in teaching people how to do this. This site:
... was preceded by more than a year of individual person-to-person email-based tech support in which thousands of people got several sets through these challenges, and almost a hundred finished.
I have zero sympathy for the people who are unwilling to put that time in, have their feelings hurt when they stumble trying to get their own systems working, and then complain of a "toxic culture" in cryptography. That "toxic culture" takes its place alongside the toxic cultures of nuclear controls system engineering, gastroenterological surgery, and appellate court law.
I have no idea whether this describes you or not, because your comment started out by asking me to look at a technical problem, then attempting to rebut a statement I didn't make, then invoking the fiasco that is the Web Crypto API, before finally complaining about toxic cultures. I don't know where to start, and so I'm hitting the eject button.
What do you think about that appcache solution to controlled updates?
You're convinced that the means justify the ends.
It is my opinion that even in nuclear controls system engineering, gastroenterological surgery, and appellate court law that being positive and supportive of your peers is probably a better approach than however you want to justify having zero sympathy for people.
Also, in my case I happen to be interested in creating something as life-threatening as a product for posting photos of cats to your friends all while having control over your digital identity/keys. I'm interested in the ecosystem of software applications that are based on open platforms and protocols like the web and driven my individual ownership of identities and data. It seems like a fun, liberating, creative and social way to make software!
I'll also hit the eject button because it is clear that you're only interested in conflict.
I'm not and have never defended this specific app. All I'm doing is pointing out that your wholesale dismissal of browser crypto is unwarranted.
You're clearly just trolling me now because you've refused to answer any of my questions specific to the valid use cases of browser crypto and how ANY software that is updated or updates itself is susceptible to issues you've levied at browser crypto.
I've been reading infosec arguments on the net since the 90s. I've heard everything there is about the dangers of creating your own crypto systems and every one of your snide remarks. tptacek has made a career off of the same 15 things you've said over and over and over again. I get it.
I also completely disagree with tptacek and every other dude who outright dismisses browser crypto. I also thing that there are a lot of important benefits from attempting the very difficult task of creating secure browser crypto environments.
Your general approach to the issue is to turn in to a raging asshole and attempt to make anyone who is exploring these issues look like a fool. You engage in an incredible amount of personal attacks and you attempt to justify the means by harping on about the importance of the ends.
I fundamentally disagree that the means can and ever will justify the ends for anything. When you do that what we're left with is assholes like you who make the world of crpyto and security an environment that is incredibly toxic to creativity.