Re: Open source secure browser-based storage, with a $1000 challenge

I would not use such a service for storing highly critical data.

I see what you mean, I mispoke. I hadn't envisioned it for use for
highly critical data. I actually developed it to store information I
already use browsers for, like a growing collection of website
passwords. I believe it could also be used for anonymous communications
with reasonable security, but very low bandwidth.

But this is meant for ordinary people who need convenient, reasonable
security and aren't willing to install and run complicated
applications, and aren't capable of verifying that they personally have
a valid copy of such applications.

If the remote server is the one supplying the Javascript code

Is this significantly different from downloading a "secure" application
written in C++ or Java? A compiled program need only be downloaded
once, but is more difficult to verify. With Javascript, the source code
is the object code, and is clearly visible and verifiable.

And because the source code is distributed from a central server, no
one need worry that they, alone, have a spiked copy of the software.
Again, it seems to me that all downloaded applications are vulnerable
to spoofing or spiking (I hope I used that term correctly), and
Javascript is among the easiest platforms to protect against such an
attack.

I would envision, if the open-source application or the website become
widely used, recruiting people to run applications that automatically
verify the Javascript. Something like a security related version of the
SETI@home phenomenon (the social phenomenon, not the technical
implementation). With a number of people monitoring the site, any
change in the Javascript code could be detected quickly, and perhaps
communicated through peer-to-peer reporting.

I believe this would protect users who chose not to run the application
as well, if any breech were detected quickly.

.

Relevant Pages

  • Re: .NET is much worse than VCL
    ... Isn't there a VCL newsgroup where you could post, where you wouldn't wind up looking like a jerk for trolling the people who on a daily basis use and enjoy the thing you are bitching about? ... I agree that's it's nice to have source code. ... 20MB really isn't all that big, and the simpler applications I ship are tens or hundreds of _kilobytes_ in size. ... If you are forced to "cope with" .NET, then I guess that means that Delphi/VCL is no longer a viable development platform. ...
    (microsoft.public.dotnet.framework)
  • Re: Microsoft MVPs Say They Want Old VB Back
    ... Web applications are definitely preferrable to the ... Microsoft to further their "software as a service" goals. ... > anyone wants the source code, just ask, or find me on groups like WMI. ... You can already see it with Linux. ...
    (microsoft.public.dotnet.general)
  • JavaScript Expert Needed (Chicago, SF Bay)
    ... Chicago-based startup seeks an experienced, dedicated and energetic JavaScript programmer to develop components of a robust, browser-hosted social networking application. ... You must have very strong AJAX-Object Oriented JavaScript skills, intimate knowledge of the DOM and experience developing XML driven applications using JavaScript. ... Work with Design Team to develop web and television interfaces, XML data input handling applications, applications to implement business rules and other web application functions. ...
    (comp.lang.javascript)
  • Re: How have code analysis tools changed the way you work?
    ... method, b will not be evaluated in C or Javascript when a is true, ... comments for readability. ... The original coder may have split a wordy comment on two lines: ... If this source code is rearranged so are the lines in the comment. ...
    (comp.programming)
  • [Full-disclosure] The state of JavaScript Hacking
    ... this than the security mailing lists. ... importance of JavaScript and other under appreciate web technologies ... As you might already know JavaScript is becoming more and more popular ... If you have less overhead with developing desktop and web applications ...
    (Full-Disclosure)