Web Crypto Claims Challenged
Web-based cryptography is questioned due to incoherent threat models, as server operators can manipulate client-side code, rendering end-to-end encryption claims untrue.
Key points
- Web applications claiming end-to-end encryption are deemed incoherent due to their threat model.
- The web platform lacks necessary functionality for true end-to-end encryption.
- Client-side code is distributed by the server operator, allowing potential malice.
- Experts argue that true security against server operator malice is unachievable with current web-based cryptography.
- This affects various services, including file upload and password safe services.
The concept of web-based cryptography has been challenged due to its inherent flaws. Web applications claiming to offer end-to-end encryption are deemed incoherent because their implementation is distributed by the same entity they purport to secure against. This means that server operators can manipulate client-side code, rendering end-to-end encryption claims untrue.
The web platform lacks the necessary functionality for true end-to-end encryption, making it impossible for web-based cryptosystems to be secure. Experts argue that true security against server operator malice is unachievable with current web-based cryptography.
This affects various services, including file upload and password safe services, which claim to offer secure storage and sharing of sensitive data. However, due to the incoherent threat model, these claims are now being questioned.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.