Archives For security

There has been so much written and discussed online and off about privacy, user control and identity lately. This dovetails nicely with the draft spec for DOMCrypt as a proposed Crypto API for web browsers.


DOMCrypt was discussed on the WHATWG mailing list last week, see:

I have summarized the discussion here:

Out of these discussions, I have updated the Firefox feature page:

A Use-cases page was created, see:

For anyone unfamiliar with DOMCrypt, this proposal in a nutshell says:

Privacy and user control on the web is of utter importance. Tracking, unauthorized user data aggregation and personal information breaches are becoming so commonplace you see a new headline almost daily. (It seems).

We need crypto APIs in browsers to allow developers to create more secure communications tools and web applications that don’t have to implicitly trust the server.

The DOMCrypt API is a good start, and more feedback and discussion will really help round out how all of this should work – as well as how it can work in any browser that will support such an API.

This API will provide each web browser window with a ‘cipher’ property[1] that facilitates:

  • asymmetric encryption key pair generation
  • public key encryption
  • public key decryption
  • symmetric encryption
  • signature generation
  • signature verification
  • hashing
  • easy public key discovery via meta tags or an ‘addressbookentry’ tag

[1] There is a bit of discussion around adding this API to window.navigator or consolidation within window.crypto

I have created a Firefox extension that implements most of the above, and am working on an experimental patch that integrates this API into Firefox.

The project originated in an extension I wrote, the home page is here:

The source code for the extension is here:

The Mozilla bugs are here:

You can test the API by installing the extension hosted at and, and going to

The API:

window.cipher = {
 // Public Key API
 pk: {
   set algorithm(algorithm){ },
   get algorithm(){ },

  // Generate a keypair and then execute the callback function
  generateKeypair: function ( function callback( aPublicKey ) { } ) {  },

  // encrypt a plainText
  encrypt: function ( plainText, function callback (cipherMessageObject) ) {  } ) {  },

  // decrypt a cipherMessage
  decrypt: function ( cipherMessageObject, function callback ( plainText ) { } ) {  },

  // sign a message
  sign: function ( plainText, function callback ( signature ) { } ) {  },

  // verify a signature
  verify: function ( signature, plainText, function callback ( boolean ) { } ) {  },

  // get the JSON cipherAddressbook
  get addressbook() {},

  // make changes to the addressbook
  saveAddressbook: function (JSONObject, function callback ( addresssbook ) { }) {  }

  // Symmetric Crypto API
  sym: {
  get algorithm(),
  set algorithm(algorithm),

  // create a new symmetric key
  generateKey: function (function callback ( key ){ }) {  },

  // encrypt some data
  encrypt: function (plainText, key, function callback( cipherText ){ }) {  },

  // decrypt some data
  decrypt: function (cipherText, key, function callback( plainText ) { }) {  },

  // hashing
  hash: {
    SHA256: function (function callback (hash){}) {  }

I am in the process of posting this proposed spec for review by the W3C webapps list and TC39. Your feedback and / or help with this effort will be greatly appreciated.


>DOMCrypt is a Firefox privacy extension I have been working on for some time. In this post I will attempt to explain what it is and why I am working on it in a somewhat non-technical manner.

What is DOMCrypt?

The core functionality is being able to take a bunch of text (or any data) and turn it into an unreadable blob via a password, right in any web page.

For instance, you can take the sentence: “Meet me in Lincoln Park by the beach at 2:00” and scramble it into something that looks like: iim08xKWVut3eqGubpq2jdCTanU7jV41q4UQKTJOoLD8y6sadUEm/8K9kpv+Wvq

The scrambled “version” of the sentence cannot be turned back into plain text unless you know the password required to convert it back.
This sentence can be sent to your contact, who alone can unscramble it and read the plain text.

The cool thing is that this kind of data scrambling – encryption – is pretty standard these days, in fact, you use this technology every time you visit a page that begins with https://.

The problem I am trying to solve is that the encryption tools in your browser are either not exposed to web pages for developers to use or the implementation (of, perhaps, an extension) is so complex, few users will ever use it.

Why DOMCrypt?

If you think about it, you realize that it is nearly impossible to communicate online without the content of the conversation recorded by a third party. Whether the purpose is ‘advertising’ or truly nefarious, you are stuck revealing your conversation to your internet provider, free email host, or social networking site. Perhaps that is not a problem to you, but to many it really is a bad situation.

The web has evolved into a network where users are tracked as web sites are traversed, their email and personal information is archived, collated, sliced, diced and indexed. Your data is not yours. This is about privacy and it is about ownership. Is privacy a relic? Is the ownership of your data important to you?

Privacy really needs to become the default configuration, a primary feature.

There is a lot of upheaval in the world right now. People all over the world need to be able to communicate privately, anonymously (or pseudo-anonymously) and quickly. With DOMCrypt, developers can build privacy-enhanced pages and applications which fully obscure at least the contents of these messages. The server that accepts these messages can be written so that there is virtually no identifiable data stored about the user.

I have created a Drumbeat project and the code is on Github.

As part of the project, I am building demo pages and web applications to demonstrate DOMCrypt in the wild. The first couple of demos show how basic encryption and an “addressbook” feature work:

I just put together a new demo that showcases a fully-working secure messaging application:

It is rough around the edges, but works and the source code is on Github.