Skip to main content
Share Your Experience: Take the 2024 Developer Survey
12 votes
Accepted

What’s wrong with in-browser cryptography in 2017?

The main issue with cryptography in web pages is that, because the code you're executing is loaded from a web server, that server has full control over what that code is and can change it every time ...
Ajedi32's user avatar
  • 4,763
8 votes

What’s wrong with in-browser cryptography in 2017?

The things that really stand out to me are 6 and 7. This is by far the thing that makes my cringe the most about this description. The entire point of setting up TOFU is that there is two way trust. ...
Nalaurien's user avatar
  • 1,654
5 votes
Accepted

Is the Web Crypto API secure when the server is trusted?

This use of the WebCrypto API sounds secure, assuming: Your server is secure and the files cannot be tampered with. This is the assumption you've provided, so I'll assume myself that you've ...
forest's user avatar
  • 66.8k
4 votes
Accepted

Are CryptoKey Objects stored in IndexedDB stored in Plain Text on the users machine?

"I need to access the key from the js environment without the user entering an encryption password" As @mti2935 points out, it is unencrypted in major browsers, and basically impossible at ...
brynk's user avatar
  • 1,101
3 votes
Accepted

Does the Web Cryptography API prevent a bad server from slurping cleartext?

It doesn't. That's excusable, because it cannot. The server sends the code. If the server is hostile or compromised, then the code sent by the server may be malicious. It doesn't matter what the API ...
Gilles 'SO- stop being evil''s user avatar
2 votes
Accepted

CryptoKey with IndexedDB to secure stateless authentication

I think you want to store an access token only as a cookie (secure, httponly, samesite: strict). Local storage can be read via js. You might want to store an ecdsa private key as unextractable key in ...
r j's user avatar
  • 138
2 votes
Accepted

Web Crypto API maturity for JavaScript RSA encryption?

Support for the web crypto API is allright, but not perfect. According to caniuse.com it got 91.5% support: You'll need to use prefixes for some older browsers, and deal with some inconsistencies in ...
Anders's user avatar
  • 65.6k
1 vote
Accepted

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

Does the cert's signature algorithm have any relevance to the signature being checked? No. The cert's signature algorithm is the algorithm that the issuing certificate authority used when creating ...
bartonjs's user avatar
  • 1,878
1 vote

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

I sure hope it is not possible to do what you are trying to do. Imagine a web-based crypto currency wallet (let's call it cryptowallet.com) that uses the Web Crypto API to create and sign transactions ...
mti2935's user avatar
  • 23.6k
1 vote
Accepted

Is possible to implement a Web Cryptography API custom provider?

See the specification 5.1: This specification assumes, but does not require, that conforming user agents do not and will not be directly implementing cryptographic operations within the user ...
mentallurg's user avatar
  • 12.4k

Only top scored, non community-wiki answers of a minimum length are eligible