Browser-based cryptography has struggled with a longstanding chicken-and-egg problem that predates many features of the modern web, and while some of those features have reduced the problem’s severity, the issue remains: What is the basis for trusting the code that performs browser-based encryption?
This question applies to popular web applications such as WhatsApp Web, Proton Mail, and Tuta, as well as to browser-based collaboration suites, crypto wallets — and of course, whistleblowing platforms. As part of our work toward a redesigned SecureDrop, we review the problem of browser-based cryptography and introduce the design requirements that are shaping our work in this area.
To read more about a problem that is legally old enough for a learner’s permit in several U.S. states, read the full article here.
