Hacker News Reader

This is where you lose me:

"...I'd figure that if they were injecting JS to steal my password, or subtly poison my RNG, and if they were doing that to everyone..."

To everyone — maybe that would get found out, maybe it wouldn't. But it doesn't have to be done to everyone. That backdoor in the JS could be served to only you. Maybe only certain times of day. How are you going to know?

View on HN

If its targeted just at you, its a different class of attack. Of course, no technology can protect against all classes of attack.

I'm just saying that there are situations where JS crypto might be useful, such as increasing the difficulty of conducting mass surveillance in secret.

Secret mass surveillance being, of course, a big topic recently.

What people need is not security that defends perfectly against every threat in theory, but no one uses in practice.

We are all open to that. Google, MS and Apple send us software updates that have root privileges on our computers. They hold the keys to our digital houses. We allow them to enter and fix our plumbing and electrical wiring almost every week, and rarely can see or understand what they "fixed". We are with our pants down.

And it's pants all the way down! Can we even trust our chips? But we stagger on.

Reply on news.ycombinator.com