Hacker News Reader

https://cryptdown.eu/view/23mz2dmpdq5co - password: lolz

and this is why we don't like crypto in the browser...

This is a cross-site scripting vulnerability, yes, but client-side crypto does not necessitate cross-site scripting.

This implementation just so happens to not protect against it properly. There are legitimate arguments against client-side cryptography; this is not one of them.

The argument is that implementing crypto within an application that is designed to download and execute untrusted code from untrusted servers and has an extremely large attack service [1] is a difficult if not dangerous task.

[1] your browser

While that may be true, that’s a different class of vulnerabilities that doesn’t include XSS.

Reply on news.ycombinator.com