Web Cryptography
summary
An overview of practical Web Cryptography work: browser support for the Web Cryptography API across Firefox, Chrome, Opera, IE and Safari; demos encrypting localStorage using CryptoJS, SJCL and Stanford libraries; performance comparisons and test plugins. Covers using openpgp.js for Gmail encryption and a real-world audit of Telegram Web that found nonrandom keys derived via SHA-1 from message content; tooling discussed includes hash crackers, browser plugins and generators with concrete parameters (IVs, key sizes) showing where encryption succeeds or fails.
AI-written summary · about
chapters (18)
- 0:00Web security basics
- 1:05Browser storage risks
- 3:57JavaScript encryption basics
- 5:22Common encryption algorithms
- 7:09Symmetric encryption in JS
- 9:19RSA asymmetric encryption
- 11:06Hash functions for integrity
- 12:14Web Crypto API standard
- 14:01Web Crypto features
- 16:07Digital signatures with keys
- 18:14Encrypt/decrypt with Web Crypto
- 21:33CryptoJS and SJCL libraries
- 23:19Performance: crypto libraries
- 25:47Node.js Crypto library
- 27:12Tools to test crypto algorithms
- 29:47Key brute-force tools
- 31:41Telegram security analysis
- 35:56Web app security best practices
related talks
39mEncrypting Data in the Browser - Exploring Web Crypto APIs
34mEncrypting Data in the Browser - Exploring Web Crypto APIs
23mKeeping secrets with JavaScript
28mDeveloping zero-knowledge solutions with JavaScript
23mJS Bringing Crypto to the Masses
20m10 Weird Applications of Public Key Cryptography
26mJavascript Crypto. Ugly duckling with good reason?
25mCryptography Isn't Scary