CryptDown – Client-side AES-encrypted Markdown pastes

Re:CryptDown – Client-side AES-encrypted Markdown pastes by dsacco on Thursday April 16, 2015 @03:49PM (#9390357)

This is a cross-site scripting vulnerability, yes, but client-side crypto does not necessitate cross-site scripting.

This implementation just so happens to not protect against it properly. There are legitimate arguments against client-side cryptography; this is not one of them.

[ Parent | on HN ]

Re:CryptDown – Client-side AES-encrypted Markdown pastes by jacksingleton on Thursday April 16, 2015 @03:56PM (#9390406)

The argument is that implementing crypto within an application that is designed to download and execute untrusted code from untrusted servers and has an extremely large attack service [1] is a difficult if not dangerous task.

[1] your browser

[ Parent | on HN ]

Re:CryptDown – Client-side AES-encrypted Markdown pastes by kragen on Friday April 17, 2015 @02:54PM (#9396401)

While that may be true, that’s a different class of vulnerabilities that doesn’t include XSS.

[ Parent | on HN ]