Search Mailing List Archives

Limit search to: Subject & Body Subject Author
Sort by: Reverse Sort
Limit to: All This Week Last Week This Month Last Month
Select Date Range     through    

[liberationtech] Crypho

Cooper Quintin cooper at
Fri Mar 22 13:59:09 PDT 2013

I had a chance to try out crypho a couple of weeks ago at a demo they
put on at noisebridge.  I have some concerns about it, namely the
delivery of crypto code over javascript without any sort of verification
of it's authenticity (via browser plugin, etc.), since this point has
already been discussed to death on this list however, I do not wish to
re-open that debate.
I managed to find a couple of javascript injection attacks in the beta
already, though the developer assures me that they are working on fixing
all the bugs right now, still the lack of attention to basic web
security at such an early stage is concerning.
That aside it seems okay, though I have some worries about side channel
attacks and the fact that it hasn't been peer reviewed as far as I can
tell yet.
It does seem like an interesting project though, with some smart people
behind it. I am looking forward to seeing the code once they open source it.

Cooper Quintin
PGP Key ID: 75FB 9347 FA4B 22A0 5068 080B D0EA 7B6F F0AF E2CA

On 03/22/2013 01:48 PM, R. Jason Cronk wrote:
> Anybody know the people who are doing this?
> It's still in beta, so I'm assuming they are working out bugs prior to
> releasing the code which they say they will do. See
>           Is it Open-Source?
>     Yes! We are reviewing the source code for release. It will be
>     available under an OSI approved license in the near future.
> *R. Jason Cronk, Esq., CIPP/US*
> /Privacy Engineering Consultant/, *Enterprivacy Consulting Group*
> <>
>   * phone: (828) 4RJCESQ
>   * twitter:
>   * blog:
> --
> Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys at or changing your settings at

More information about the liberationtech mailing list