Search Mailing List Archives
[liberationtech] Is cryptico.js any good?
unclezzzen at gmail.com
Wed Oct 12 17:26:25 PDT 2011
-----BEGIN PGP SIGNED MESSAGE-----
I took the liberty of publishing your reply, since I'm not the only
one who was asking this:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-----END PGP SIGNATURE-----
On Thu, Oct 13, 2011 at 5:37 AM, Steve Weis <steveweis at gmail.com> wrote:
> Regardless, I wouldn't trust Cryptico because its underlying implementations
> are all written from scratch and I have no idea if any of them are safe.
> Quickly scanning through their code, I see some questionable practices.
> For example, they are seeding randomness from the time of day:
> And the "signature" is just a hash and is on the plaintext, rather than
> On Wed, Oct 12, 2011 at 2:56 PM, Uncle Zzzen <unclezzzen at gmail.com> wrote:
>> At the bottom of https://code.google.com/p/cryptico/ there's a tech
>> summary of the algorithms and libraries it uses.
>> Anyone here knows it? How good is it? Is there any reason NOT to use it?
>> Any other considerations? (e.g. if it's not over SSL - client-side
>> code can be MITMed).
>> The Dod
4759 A11D 6E05 D778 4A51 A002 A758 BD37 C2C1 AEFB
More information about the liberationtech