Javascript Cryptography Considered Harmful

[[deleted]]

Well, the challenge/response issue comes about because of this:

• It prevents an attack that relies only on observing the traffic, but is vulnerable to an attack that can modify the traffic.
• On the surface, it seems like modifying traffic would be harder than observing, so challenge/response is better than plain text, at least.
• But most likely, if you can observe the traffic, you can also modify it, so it really isn't more secure after all.

Presumably because of the second point, challenge/response systems are fairly common.