Nothing to do with Javacript. JOSE is just very, very complicated. Until a few months ago, I reviewed systems like this professionally, and none of the good ones needed anything like the complexity of JOSE to solve their problems.
I'm automatically wary of meta-crypto-protocols. If it isn't designed against a very specific problem statement, cryptography is almost invariably bad.
Can't read tptacek's mind, but I'm guessing it has to do with the fact that javascript cryptography running in the browser cannot provide the guarantees necessary for a reliable cryptosystem. You can't tell whether the browser has been compromised or is malicious. Although strictly; speaking there may be other good reasons to use this standard and plenty of non-browser contexts for javascript execution do exist and aren't necessarily as vulnerable.
Comments
Why?
Nothing to do with Javacript. JOSE is just very, very complicated. Until a few months ago, I reviewed systems like this professionally, and none of the good ones needed anything like the complexity of JOSE to solve their problems.
I'm automatically wary of meta-crypto-protocols. If it isn't designed against a very specific problem statement, cryptography is almost invariably bad.
Can't read tptacek's mind, but I'm guessing it has to do with the fact that javascript cryptography running in the browser cannot provide the guarantees necessary for a reliable cryptosystem. You can't tell whether the browser has been compromised or is malicious. Although strictly; speaking there may be other good reasons to use this standard and plenty of non-browser contexts for javascript execution do exist and aren't necessarily as vulnerable.