Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by mcraiha | Hacker News Reader

Full thread

mcraiha·

My beef is with Web Crypto. Why are encrypt and decrypt async?

View on HN

Because otherwise the main thread will be blocked while those operations take place and the whole ui will freeze

You'll find this convention in other JS crypto stuff as well, like libraries for password hashing. Eg:

https://www.npmjs.com/package/@node-rs/argon2

https://www.npmjs.com/package/bcrypt

Though the bcrypt package does provide an additional sync API. (You should be using argon2 though.)

Yes, but you can offer both sync and async methods. Web Crypto only has async.

Programmers who are not aware of the pitfalls will use the sync version and build apps that have terrible ux, so it’s better to not give them the option unless there’s a really good reason to, so what’s the use case here?

You're forced make all of your code async all the way down to lowest crypto calls, even if you handle the async way higher in abstraction layers.

How would you "handle the async" at a different layer? If you were to call sync crypto methods, they'd block the event loop no matter where you call them - unless you call them from a Worker, at which point they're async calls again.

The only real use case would be small scripts where you don't care about sync/async, but experience shows that devs will abuse the sync functions in scenarios where the async ones would be appropriate.

Cause they can be slow.

And we're still awaiting any of their benefits.

Reply on news.ycombinator.com