Re: [cryptography] Javascript Password Hashing: Scrypt with WebCrypto API?

2015-03-13 Thread Izaac 
On Fri, Mar 13, 2015 at 12:29:58PM -0600, Jeffrey Goldberg wrote:
 OK. So I guess we return to the original question, does anyone know of
 an scrypt implementation in JavaScript?

They've already been posted.  But unlike Alexander who was kind enough
to repeat himself, I won't give any further encouragement to folly.

Stop.  Really: stop.

Client-side-in-browser JavaScript crypto does not and cannot provide
security.  Like building a castle from jello, it is flawed in
conception.

-- 
. ___ ___  .   .  ___
.  \/  |\  |\ \
.  _\_ /__ |-\ |-\ \__
___
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography

Re: [cryptography] Javascript Password Hashing: Scrypt with WebCrypto API?

2015-03-11 Thread Izaac 
On Wed, Mar 11, 2015 at 11:53:35AM +0100, Fabio Pietrosanti (naif) - lists 
wrote:
 at GlobaLeaks we're undergoing implementation of client-side encryption

Okay.  I'm going to elide the fine points of madness here and just refer
you to: 

   http://matasano.com/articles/javascript-cryptography/

-- 
. ___ ___  .   .  ___
.  \/  |\  |\ \
.  _\_ /__ |-\ |-\ \__
___
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography