Comment by quadhome | Hacker News Reader

Comment by quadhome | Hacker News Reader

I'll wait for the cryptographers to weigh in; but, it's in Javascript.. already a language that's going to be hard to Do It Right in. (The first third of the code is a BigInteger implementation)

Then, I looked to see if the standard constant-time comparisons were in there to resist timing attacks. No dice there.

So... cool. He put a nice wrapper on JSAES[1], jsSHA2[2] by way of webtoolkit.info[3], RSA and ECC in Javascript by Tom Wu[4], and seedrandom.js by David Bau[5].

But then then says it's "New BSD license"[6] when it should be GPL[7].

I didn't start this comment sound negative. But, I think a few things are important:

* Credit authors.

* Respect their licenses.

* Put a big fucking notice on top of your slick webpage: "FOR DEMONSTRATION PURPOSES ONLY-- NOT REAL CRYPTO"

[1] http://point-at-infinity.org/jsaes/ [2] http://anmar.eu.org/projects/jssha2/ [3] http://www.webtoolkit.info/javascript-sha256.html [4] http://www-cs-students.stanford.edu/~tjw/jsbn/ [5] http://davidbau.com/archives/2010/01/30/random_seeds_coded_h... [6] http://code.google.com/p/cryptico/ [7] http://code.google.com/p/cryptico/source/browse/trunk/aes.js

He credits the authors in his doc, but agreed on the warning - I am not a cryptographer, but my knowledge of side-channel attacks has me pretty worried that the RSA implementation is not safe.

Does anything qualify as 'real crypto'? Every implementation will always and forever have weaknesses. I don't have a problem with someone putting together a package that makes it easy to do crypto stronger than rot13 - isn't that a step forward? We'd all like GPG/PGP easy in the browser with native code, but until then, what's wrong with an intermediate step that appears to be at least pretty good and fairly easy to use? Maybe it's not enough for organizing a coup, but for keeping your fantasy football strategies a secret - why not?

Code that has been written and/or audited by cryptographers would qualify as 'real crypto.' I don't think anybody has a problem with someone putting together this package; the only problem is with the lack of a proper notice that the code hasn't been audited.

That's a fair point. The idea that it could be used "for demonstration purposes only", though, seems to go too far in that direction. It seems like a useful library, just not for organizing a coup.

Javascript cryptography is breakable by teenagers. The attacks don't require a government.

I would argue that rot13 is better than unencrypted, and that this is a step up from rot13. Sure, it's imperfect, but it's still better than nothing, and while I'm only a mediocre programmer, it appears to be easy-to-use, to boot. Better-than-nothing and easy-to-use seems like something more useful than "for demonstration purposes only", don't you think?

I am fine with stipulating that Javascript cryptography is approximately as good as rot13, and so we can move on.

Really? You can't concede that an implementation like this is better than rot13?

If you're in a position to intercept the traffic, then you can likely rewrite it. That includes the JS.

The company I work for (who for obvious reasons I will refuse to mention) refuses to implement standard cryptographic practises in its product. Several months after starting there, and after a lot of loud complaining, I managed to get them to switch to using bcrypt instead of plaintext passwords in the backend database. Only in the next release are they switching to using TLS for logins, and even then sometimes defaulting to a clearly fucked Javascript implementation of cryptography to send the password (using public key crypto with global server key that only changes on server restart, with replay attacks galore).

The one thing I can say about the JS cryptography is that it normally protects somewhat against passive sniffing attacks, but when it's as broken as this, it doesn't even accomplish that task.

This sort of thing seems chronic in the industry, and it's dismaying.

And as we both know, the "passive sniffing attacker" is a myth. If you can sniff packets, you can intercept traffic. We don't reason about security mechanisms by tying the attackers hands behind their back.

But of course. Preaching to the choir.

Management made the decision that my trivial change to eliminate replay attacks was "too much effort". I am inclined to agree, since even with such a change the effort required to circumvent their entire so-called security is minimal.

Next quarter they're introducing e-commerce solutions. Dear god.

One might argue that, if an unnamed company's e-commerce solution would put a lot of people at risk, and an unnamed engineer can prove it, that unnamed engineer has an ethical obligation to discreetly report the vulnerability first to the unnamed company, then to successively more influential and more public venues (e.g. consumer protection groups, security research groups, etc.), until the company responds.

One might argue that such a course of action will simply get the engineer pointlessly fired.

Sometimes plain text is safer. Otherwise people have the illusion of security.

Why do you say that? If properly implemented strong crypto is strong, regardless of the language.

See the link I posted elsewhere on the thread.

Reply on news.ycombinator.com