Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 added 130 characters in body
source | link

It depends on the computer, operating system and user agent running the Javascript and the website. If either of those is compromised, then malware can get the information sent by the server to te client. For example XSS attacks can compromise the website, and the browser vendor can in theory impersonate you on any website, you are just trusting their software not to let them do it.

So yes, this is about as good as you can get. The more keys are required, the better.

The problem is, lakano, once a stored key is unwrapped in Web Crypto, I don’t think there is a way to mark the result as “non extractable”. I wish there would be a way to combine wrapping and “non extractable” keys. Have you found a way?

I have been asking for a year and no one really knows: https://gist.github.com/saulshanabrook/b74984677bccd08b028b30d9968623f5

It depends on the computer, operating system and user agent running the Javascript and the website. If either of those is compromised, then malware can get the information sent by the server to te client. For example XSS attacks can compromise the website, and the browser vendor can in theory impersonate you on any website, you are just trusting their software not to let them do it.

So yes, this is about as good as you can get. The more keys are required, the better.

The problem is, lakano, once a stored key is unwrapped in Web Crypto, I don’t think there is a way to mark the result as “non extractable”. I wish there would be a way to combine wrapping and “non extractable” keys. Have you found a way?

It depends on the computer, operating system and user agent running the Javascript and the website. If either of those is compromised, then malware can get the information sent by the server to te client. For example XSS attacks can compromise the website, and the browser vendor can in theory impersonate you on any website, you are just trusting their software not to let them do it.

So yes, this is about as good as you can get. The more keys are required, the better.

The problem is, lakano, once a stored key is unwrapped in Web Crypto, I don’t think there is a way to mark the result as “non extractable”. I wish there would be a way to combine wrapping and “non extractable” keys. Have you found a way?

I have been asking for a year and no one really knows: https://gist.github.com/saulshanabrook/b74984677bccd08b028b30d9968623f5

1
source | link

It depends on the computer, operating system and user agent running the Javascript and the website. If either of those is compromised, then malware can get the information sent by the server to te client. For example XSS attacks can compromise the website, and the browser vendor can in theory impersonate you on any website, you are just trusting their software not to let them do it.

So yes, this is about as good as you can get. The more keys are required, the better.

The problem is, lakano, once a stored key is unwrapped in Web Crypto, I don’t think there is a way to mark the result as “non extractable”. I wish there would be a way to combine wrapping and “non extractable” keys. Have you found a way?