JavaScript Cryptography Considered Harmful(nccgroup.trust)
nccgroup.trust
JavaScript Cryptography Considered Harmful
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/
1 comments
[deleted]
When one makes quite huge accusations, as these are obviously, going strong against best practices laid out by researches, both from Google and Amazon (and probably a lot more), it would be better to not only hate-talk, but also - quite simply - proof. Show, for example, how you can intercept JS sent from the server via https. Or show how somebody did that. Or how you are going to XSS in any major JS Framework out there. Or at least link some examples when you make assumptions that all JS crypto won't work because of things like
> "cross-site scripting". Virtually every popular web > application ever deployed has fallen victim to this problem
XSS Sanitation was for long time a problem and, of course, it still is, when used the wrong way. There were plenty of hacks and attacks using cross site scripting, no doubt.
or
> WHAT SYSTEMS PROGRAMMING FUNCTIONALITY DOES JAVASCRIPT LACK? > Here's a starting point: a secure random number generator.
https://www.w3.org/TR/WebCryptoAPI/#dfnReturnLink-0
... and so on ...