Do you think a dedicated native client would work? Something like a lightweight site-specific browser with Crypton libs. The same way you can appify sites with Chrome.
> Do you think this can be remedied by moving the code out of the web container?
That's what I did in my own design. My protocol's purpose is different from cryptocat's, but the problem that in-browser javascript is untrustworthy is the same.
I designed my protocol so that it needn't be embedded in the browser at all -- or for that matter, piggybacked on HTTP.
Comments
Do you think this can be remedied by moving the code out of the web container?
Cryptocat moved away from delivering its crypto code over JS to a browser plugin: http://www.forbes.com/sites/jonmatonis/2012/07/30/cryptocat-...
Do you think a dedicated native client would work? Something like a lightweight site-specific browser with Crypton libs. The same way you can appify sites with Chrome.
> Do you think this can be remedied by moving the code out of the web container?
That's what I did in my own design. My protocol's purpose is different from cryptocat's, but the problem that in-browser javascript is untrustworthy is the same.
I designed my protocol so that it needn't be embedded in the browser at all -- or for that matter, piggybacked on HTTP.