View source for Biting into the forbidden fruit. Lessons from trusting JavaScript crypto

From BruCON 2017

← Biting into the forbidden fruit. Lessons from trusting JavaScript crypto

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

You can view and copy the source of this page.

We all know JS crypto is flawed, right? Over the years, security community has pointed out its multiple fundamental problems. Several arguments were made and "JavaScript cryptography is bound to fail" became a mantra. Of course, despite all this JS crypto WAS used all over the place. Theory met practice - it was about time to dig into this!

In recent months, we tested various high-profile, in the wild crypto libraries, applications and systems. We saw code from home-grown cryptography to full-blown TLS or OpenPGP implementations. Hilarious bugs were spotted, protections were bypassed and systems were pwned. But was it really that different from what we all had already seen in OpenSSL, BouncyCastle or GnuPG? Can we actually fix all those bugs? Does it mean that Javascript cryptography can be, pardon us saying, secure like any other?

Come and listen. During the talk vulns will be shown, authorities - questioned, myths - debunked, and browsers cursed upon. You'll see the full picture - from XSS, to man-in-the-middle, to PRNGs and timing side-channels, even snippets in C. No stone will be left unturned, nothing will be taken for granted. You'll be left with an updated, solid and heavily opinionated view of JavaScript cryptography.

Return to Biting into the forbidden fruit. Lessons from trusting JavaScript crypto.

Retrieved from "https://2017.brucon.org/index.php/Biting_into_the_forbidden_fruit._Lessons_from_trusting_JavaScript_crypto"

navigation

SEARCH

TOOLBOX

LANGUAGES

View source for Biting into the forbidden fruit. Lessons from trusting JavaScript crypto

From BruCON 2017