Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Does this solve any of the in-browser encryption issues that are outlined in these links [0][1][2]?

    [0] http://tonyarcieri.com/whats-wrong-with-webcrypto
    [1] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/
    [2] http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/


I would say "avoids" rather than "solves." The issues raised in those posts are real issues, but they mostly have to do with the question of whether or not you can trust the server. With SC4, you don't have to trust the server -- or at least you don't have to trust our server. SC4 consists entirely of static files, so it's trivial to deploy from any server, including your own. You can even run it from a FILE: URL, though that actually turns out to be less secure (SC4 takes special precautions in this case). So browser-based crypto is far from ideal, but it can be better than nothing. In particular, it can be the 80/20 solution with respect to security versus implementation effort and deployment hassle.

If you want more details I'm happy to provide them.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: