
Show HN: Home-made crypto in the browser - projectant
http://requirebin.com/?gist=0651c4d15c202b3e986e764294d3b028
======
projectant
Usual caveats for home-made crypto apply.

TL;DR - treat this as you would home-made beer from someone you don't know.
You'd probably hold it at arms length, have a smell, and maybe try the
taste...but you wouldn't start selling it in your hip bar without knowing
anything about it!

Anyway, hope others interested in crypto can enjoy this. I am not a crypto-
expert, just a moderately-talented-at-crypto-hobbyist, or somethin. Code:
[https://github.com/dosyago-coder-0/dosycrypt](https://github.com/dosyago-
coder-0/dosycrypt)

~~~
the8472
And the usual caveats for in-browser encryption apply. Namely that the trust
model is no different from temporarily handing the encryption keys to the
server.

In the latter case you trust the server to discard the keys after them being
used. In the former case you trust the server to not transiently serving you
javascript that exfiltrates the keys. In both cases this trust has not just to
be extended once (which would make things auditable) but during every single
transaction.

~~~
emagdnim2100
This is far from true. Client-side crypto at least gives you the ability to
inspect outgoing network traffic. This should help to keep site operators
honest.

The site operator can of course nefariously and randomly serve JS that
exfiltrates keys, but users at least have the _ability_ to audit every single
transaction.

~~~
the8472
That I assuming that every type network request is covered by available
monitoring tools and that they are user-friendly. What if web browsers allow
you to trigger DNS lookups without HTTP requests? That could already be used
to exfiltrate data.

~~~
JetSpiegel
> What if web browsers allow you to trigger DNS lookups without HTTP requests?

Just include hidden links in the page, most browsers have some sort of pre-
fetch optimization that does exactly that. I think they make HTTP connections
on hover even.

------
indescions_2017
Thanks for introducing me to RequireBin. Love the gist recognition ;)

[http://requirebin.com/](http://requirebin.com/)

------
lisper
Another in-browser crypto project based on TweetNaCl:

[https://github.com/Spark-Innovations/SC4](https://github.com/Spark-
Innovations/SC4)

SC4 has undergone a security audit.

~~~
hlieberman
It’s also non-free (and under a license that is distinctly not made for code.)

~~~
lisper
> It’s also non-free

Not true. And if there something you don't like about the licensing, it would
be more constructive to begin by asking the author privately if they'd be
willing to change the license terms rather than complain about it on a public
forum.

~~~
abstractbeliefs
France, and many other jurisdictions, don't recognise the concept of releasing
directly into the public domain, so in this case would leave you high and dry
in the future theoretical of the original author changing his mind about your
use of his library.

If people really want to release into the public domain, public domain with
French exceptions like CC0 are the best option.

~~~
detaro
TweetNaCl-js is under such a "public domain with fallback" license, so I'm not
sure what you are complaining about.

(And even if it weren't, pure use is not as critical as e.g. wanting to
contribute to it)

------
lifeisstillgood
don't the major browsers have apis to built in crypto libraries - you can
basically ask for many operations from JS?

~~~
reimertz
They do:
[https://caniuse.com/#feat=cryptography](https://caniuse.com/#feat=cryptography)

~~~
danesparza
From that page: "Many browsers support the crypto.getRandomValues() method,
but not actual cryptography functionality under crypto.subtle. "

