JS Bringing Crypto to the Masses
summary
Argues that web apps must handle cryptography client-side and gives concrete pitfalls and fixes: JavaScript lacks integer primitives and Math.random is unsafe so use a crypto-secure RNG (URandom/crypto API), prefer AES-128/256 CBC with IV over ECB, encode cipher blobs as base64/hex, and keep keys secret. Cites a Taiwan smart-card incident where ~200 weak keys appeared among 2 million, shows why keyspace matters, and reports having built a custom authentication system that survives testing. Recommends Applied Cryptography and the Montaño crypto challenges.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:08Why cryptography feels scary
- 3:56Cryptography in modern privacy concerns
- 6:44What cryptography actually is
- 9:10Binary data and algorithm basics
- 11:37Randomness and key generation
- 13:44XOR and block ciphers
- 16:34ECB vs CBC encryption modes
- 18:00Cryptography in JavaScript challenges
- 20:48Why browser crypto matters
- 21:50Call to action and resources
related talks
26mJavascript Crypto. Ugly duckling with good reason?
25mCryptography Isn't Scary
34mEncrypting Data in the Browser - Exploring Web Crypto APIs
52mCryptography 101 for Java developers
39mWeb Cryptography
39mEncrypting Data in the Browser - Exploring Web Crypto APIs
30mAre we using Java Crypto API Securely ?
28mModern Cryptography