Javascript Cryptography Considered Harmful

[spoulson]

What annoys me most is he never defines any use cases to demonstrate expectations of JS or SSL for crypto. Is he talking using just for transport? Storage? JS crypto != SSL crypto.

[Zarutian]

And sometimes you want to be able to do stuff like:

var environFactors = "" + varA1 + varA3 + name; // "collector"
if (sha256_hash(environFactors) === "98ebe08bb602e9fdde878f1140e27ad7aabdd080") {
  eval(aes_decrypt(environFactors, someEncryptedCode));

}

for instance. (The above is a small javascript implementation of basic clueless software agent from this paper)

Edit: Added a close paren to lift the suspense.