HN user

8rian

18 karma
Posts0
Comments7
View on HN
No posts found.

Left to their own devices, people would never upgrade. This is a security risk for MS. (Win 8 support ends January 2018). Chrome was championed for auto updating, and now all browsers do the same. Web apps can auto update whenever they want. Mobile apps auto update. Why shouldn't operating systems?

New keypairs would be generated on the client every time you join a chatroom. Another member of the chatroom sends you the shared_key encrypted by your public key. Server knows nothing, stores no keys. Keys exchanged between users.

Javascript crypto is still a problem though: http://matasano.com/articles/javascript-cryptography/

When you re-download the codebase on every use, there is no way to ensure integrity of the code. This is the reason cryptocat ships as a chrome extension, because it is downloaded once. Even with these issues, I'd take javascript crypto + open source over nothing (or just SSL).