Questions tagged [web-crypto-api]

The Web Crypto API is a JavaScript standard for cryptographic primitives, allowing web applications to do cryptogarphy in the browser.

Filter by
Sorted by
Tagged with
0
votes
0answers
74 views

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
1
vote
1answer
156 views

Are CryptoKey Objects stored in IndexedDB stored in Plain Text on the users machine?

I'm considering storing a sysmetric encryption key in the form of a CyptoKey Object with extractable set to false in IndexedDB and I was wandering whether this is safe or not. The questions that I ...
2
votes
1answer
58 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
-1
votes
1answer
191 views

Find Confirmation Code (FindBug.io) [closed]

I have solve half of the problem by decoding a base64 code that reveal the next URL(https://app.findbug.io/app/task/FinDBuG-CTF2019) but now i don't know what to find or where i tried it with ...
1
vote
1answer
480 views

Web Crypto API maturity for JavaScript RSA encryption?

We have been using a JavaScript crypto API to do RSA encryption in the browser. I know all the criticisms on encryption in JavaScript but we have evaluated pros and cons of the solution and the risks ...
3
votes
0answers
2k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
1
vote
1answer
54 views

Does the Web Cryptography API prevent a bad server from slurping cleartext?

Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely: private keys ...
21
votes
3answers
4k views

What’s wrong with in-browser cryptography in 2017?

There are many articles in the internet criticising JavaScript cryptography in the browser: "What’s wrong with in-browser cryptography?" by Tony Arcieri "Final post on Javascript crypto" on rdist "...