this doesn't, it uses the browser's builtin Web Cryptography API.
if using a crypto algorithm also counts as "rolling your own crypto" then what's left? just don't encrypt anything, ever, because HN says we shouldn't roll our own?
Yes, using a crypto algorithm also counts as rolling your own crypto. You're putting together crypto libs that others wrote. Most crypto vulnerabilities come from glueing together solid crypto implementations. The glueing has to be solid too. Just "using" a crypto algorithm sounds like a recipe for a vulnerability.
I'm not a crypto expert, I'm just telling you what I've been reading on HN for the past few years.
You're not completely wrong in that it's still possible to f up, even when using misuse resistant primitives.
The difference is, you're sort-of allowed to f up if it's an intelligent mistake that teaches the creators of misuse resistant libraries a thing or two about where they went wrong. If OTOH you're clearly just yoloing it, introducing your pseudo-math BS into the mix, or intentionally deviating from best practices or breaking it, then it's on you.
this doesn't, it uses the browser's builtin Web Cryptography API.
if using a crypto algorithm also counts as "rolling your own crypto" then what's left? just don't encrypt anything, ever, because HN says we shouldn't roll our own?
Yes, using a crypto algorithm also counts as rolling your own crypto. You're putting together crypto libs that others wrote. Most crypto vulnerabilities come from glueing together solid crypto implementations. The glueing has to be solid too. Just "using" a crypto algorithm sounds like a recipe for a vulnerability.
I'm not a crypto expert, I'm just telling you what I've been reading on HN for the past few years.
You're not completely wrong in that it's still possible to f up, even when using misuse resistant primitives.
The difference is, you're sort-of allowed to f up if it's an intelligent mistake that teaches the creators of misuse resistant libraries a thing or two about where they went wrong. If OTOH you're clearly just yoloing it, introducing your pseudo-math BS into the mix, or intentionally deviating from best practices or breaking it, then it's on you.
re-using primitives is on a completely different level from creating your own cipher.
[flagged]
1 reply →
They didn’t roll their own crypto? They used the web crypto API provided by the web browser.
I can't be the only one who thinks this wallet will be emptied before 2023.
Security by obscurity is real, there's nothing secret about defining the problem space in which your attackers can search.
I'd be happy to see the wallet emptied.
This is what the bounty is for. I just hope whoever cracks it lets me know how they did it and how hard it was.
This is what a bounty is, no?
$400 is nothing, put your life savings into this system if you trust it so much.
It's a cute marketing gimmick, that's about it.
1 reply →