comments on web crypto API: Extractable keys [5/6] from Nikos Mavrogiannopoulos on 2013-05-23 (public-webcrypto-comments@w3.org from May 2013)

From: Nikos Mavrogiannopoulos <nikos.mavrogiannopoulos@esat.kuleuven.be>
Date: Thu, 23 May 2013 10:44:09 +0200
To: <public-webcrypto-comments@w3.org>
Cc: danny de cock <Danny.DeCock@esat.kuleuven.be>, Filipe Beato <filipe.beato@esat.kuleuven.be>
Message-ID: <bb1d93baca1f70d05b1158912ac551de@esat.kuleuven.be>

This API allows for keys that are extractable meaning that the 
javascript code would not just use the keys, but it will also transfer 
them to the server or to another party. We see more possibilities for 
malicious usage of this practice, than legitimate usage, so we propose 
to _not_ allow extractable keys at all.

Received on Thursday, 23 May 2013 10:12:58 UTC