Saltshaker-Crypto
Security and privacy
encryption library
SHOW HN2019
How HN took it
0 positive, 0 neutral or asking, 0 mixed, 5 critical, out of 5 comments about the project. Thread score -0.50.
Privacy: 0 for, 3 againstExecution: 0 for, 1 againstIdea: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
tweetnacl-js is a well-regarded, security-audited library
From 1 comment
Seems like the right library to post is https://github.com/dchest/tweetnacl-js which actually has been security audited
jitl on HN
Objections
Included unauthenticated AES-CBC encryption, which is insecure and has padding oracle risks
From 3 comments
Help me understand. You've written a small Javascript wrapper around 'dchest's Javascript port of tweetnacl, and then added to it the ability to insecurely encrypt and decrypt…
tptacek on HNIt is really strange that they added another library to do unauthenticated AES when nacl has a symmetric AEAD mode...
jszymborski on HNWasn’t use of CBC strongly discouraged because it allowed for padding oracles ?
stingraycharles on HN
Wrapping a library adds little value over using tweetnacl directly
From 1 comment
Help me understand. You've written a small Javascript wrapper around 'dchest's Javascript port of tweetnacl, and then added to it the ability to insecurely encrypt and decrypt…
tptacek on HN
Requests
Remove the AES-CBC code and use NaCl's AEAD mode instead
From 2 comments
It is really strange that they added another library to do unauthenticated AES when nacl has a symmetric AEAD mode...
jszymborski on HNRevisit the AES by removing the AES.
tptacek on HN
Questions
Why add unauthenticated AES alongside NaCl
From 2 comments
Help me understand. You've written a small Javascript wrapper around 'dchest's Javascript port of tweetnacl, and then added to it the ability to insecurely encrypt and decrypt…
tptacek on HNIt is really strange that they added another library to do unauthenticated AES when nacl has a symmetric AEAD mode...
jszymborski on HN
Alternatives named
tweetnacl-js (dchest)
From 1 comment
Seems like the right library to post is https://github.com/dchest/tweetnacl-js which actually has been security audited
jitl on HN