On Mon, Jul 21, 2014 at 5:52 PM, Aymeric Vitte <[email protected]> wrote:
> You obviously don't know what you are talking about or just did not get > what I explained or just do not understand http versus https or the > contrary, or just do not understand the web, what's on client side > (browser) or on server side, or don't get that your extension can be mitmed > too including its signature. > Hey, it's just my job. I also write a whole blog post on the matter: http://tonyarcieri.com/whats-wrong-with-webcrypto I develop webapps that are served over HTTPS, HSTS, and use Content Security Policy (CSP). You write webapps that are served over plaintext HTTP and don't use content security policy, and if they did, it wouldn't matter, because an active attacker can write the CSP header unless you're using HTTPS. tl;dr: I am using state-of-the-art web security. You are selling snake oil. You are vociferously defending your snake oil. but first checkout what is writen on Peersm site, everything is explained > Your site is broken. It's unsafe. You don't know what you're doing. You're clueless, and worse, you have some kind of Dunning-Kruger complex that makes you think the opposite of what you should be doing from a security perspective is a good idea. There's no beating around the bush here. You are wrong, wrong, wrong. Peersm is horribly insecure, and nobody should be using it. Please read about the problem. I already linked you the Matasano article: http://matasano.com/articles/javascript-cryptography/ But please also consider reading the book the Tangled Web: http://www.amazon.com/The-Tangled-Web-Securing-Applications/dp/1593273886 Here is a checklist of things you don't have which, at a minimum, you need to implement for your site to be remotely secure (and even then, users of your site are still vulnerable to you changing the code and exfiltrating their secrets): - HTTPS: https://en.wikipedia.org/wiki/HTTP_Secure - HSTS: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security - CSP: https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy -- Tony Arcieri
-- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at [email protected].
