Browser crypto is really problematic. For one, the client is downloading the crypto JS implementation (almost) every time they are using the app. Server compromised? crypto.js is rendered useless. HTTPS certificate compromised? crypto.js is useless.
And also:
XSS vuln on your website? crypto.js is useless since attacker will just exfiltrate your private key / password through XSS.
The browser is wonderful for UI but mashing together code and markup and then trying to permissively parse and execute it never goes well for security.
And also:
XSS vuln on your website? crypto.js is useless since attacker will just exfiltrate your private key / password through XSS.
The browser is wonderful for UI but mashing together code and markup and then trying to permissively parse and execute it never goes well for security.