Re: Secure origin requirement in Chrome/WebCrypto

On Sep 24, 2014 11:27 PM, "Anders Rundgren" <anders.rundgren.net@gmail.com>
wrote:
>
> During my work with a WebCrypto-enabled application I found that
> Firefox "Nightly" and Chrome "Canary" have different behavior.
>
> Chrome apparently requires HTTPS (presumably also with a "genuine"
> certificate)

Presumption is not correct.

> for executing some (?) methods like import of keys.

All methods.

>
> I perfectly well understand the motives but it makes *development* harder.
> IMO, it would be better to making this requirement a recommendation.
>

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25972

> WebCrypto won't anyway be useful for people who lack insight in applied
> cryptography, secure protocols and server hardening but that's entirely
OK :-)
>

We disagree.

http://www.chromium.org/Home/chromium-security/security-faq#TOC-Why-are-some-web-platform-features-only-available-in-HTTPS-page-loads-

> Cheers,
> Anders
>