nitrokey-websmartcard

It's a pity the web doesnt have standards for security devices helping to encrypt content. Twitter or anyone else would have to go build end to end encryption. NitroKey threw together a sample web platform api for using FIDO devices to secure content[1]. No real uptake though. This still might not help the case here, where other people also need to be able to decrypt with the public key. In general, I think the perspective is at the nose of where we are: regulation & clampdowns abound, nations-states making up endless reams of expectations & demands. Data is no longer oil: data is toxic[2]. [1] https://github.com/Nitrokey/nitrokey-webcrypt [2] https://www.schneier.com/blog/archives/2016/03/data_is_a_tox... https://news.ycombinator.com/item?id=11273356 (180 points, 6 years ago, 65 comments)

> WebAuthn is about presenting credentials to the server from the security key. The server gets to check our private keys, but the end client (the page) doesn't have any validation or tools at it's own disposal. Clients get to check the servers TLS certs & DNS entries for proof that they are who they say they are. > NitroKey & myself want the web to have a standard way to encrypt & secure data, ideally that allows for security keys to help do (sign) the encryption. https://github.com/Nitrokey/nitrokey-webcrypt OH, so you want a way for the server to encrypt data just for a given client, that they can't read. This doesn't really make a ton of sense. The server has to have the plaintext version to encrypt, which means they have the data un-encrypted before they encrypt it for you. Hence you MUST trust the server with your plaintext data.

WebAuthn is about presenting credentials to the server from the security key. The server gets to check our private keys, but the end client (the page) doesn't have any validation or tools at it's own disposal. NitroKey & myself want the web to have a standard way to encrypt & secure data, ideally that allows for security keys to help do (sign) the encryption. https://github.com/Nitrokey/nitrokey-webcrypt

Hi chiming in to double down on this, as the downvotes ongoingly slowly slowly creep downward even still. In most places, end-to-end security is the goal. But we've literally built the web crypto model to ensure the end user reaps no end-to-end benefit from web cryptography. The alternative would be to trust the user-agent, to allow end-to-end security. But we don't allow this. We primarily use crypto to uniquely distinctly identify users, as an alternative to passwords. This is a busted jank ass sorry sad limited piece of shit way for the web to allow cryptography in the platform. This is rank. The Nitrokey security key people saw this huge gap, & created a prototype/draft set of technologies to enable end-to-end web encryption & secure storage with their security keys. https://github.com/Nitrokey/nitrokey-webcrypt

We are building Web Crypt which can be used for encryption purposes in web browsers. https://github.com/Nitrokey/nitrokey-webcrypt/