As soon as you build richer and heavier applications that have any data or logic on the client, you get into the world of security. Ajax security is a hot topic. On the one hand, the game hasn’t changed at all:
Don’t trust the client!
But we see XSS, CSRF, and other tactics being used to do bad things. With the Gears Database component, we have to think about how safe that data is. Although data on a local machine is a bad thing, we have seen people using encrypted partitions to give some level of security. What if we could have a layer of Crypto in Gears itself? This would mean that a Web developer could use Crypto anywhere in their Web application.
Dojo Offline put encryption on top of Gears. In Dojo SQL you can use a magic
ENCRYPT() function in your SQL string and it will be grabbed out and encrypted for you.
“Under the covers Dojo SQL’s cryptography is powered by 256-bit AES,
using the passphrase you provide to derive the key. Specifically, we use
how it works; special thanks to Chris Veness for contributing the AES
encryption code to Dojo.”
There are some big questions when you really think about what a Gears Crypto API should be:
- How low level should it be? Just a wrapper on something like openssl?
- Should we just put encryption into the existing APIs?
- What are we truly trying to solve here?
In general, when you aren’t sure, you end up getting low level APIs and you sit and wait for developers to built on top of it. This is one area where I would like to see a higher level API. In my experience, Crypto APIs are always too complex and in your face. Often you don’t want to choose a million options. You want to say “Erm, can you just encrypt this really well?”.
Would you like to see a crypto API that you could just use? If so, what would you actually like to see!
Other Future APIs
- Developer Tools
- Factory API updates
- Blob API
- Logging API
- Messaging API
- Location API
- Desktop Shortcut API
- Image Manipulation API
- Introduction to the series
Disclaimer: This is me rambling about APIs and tools that I would love to see in Gears, or the Open Web as a whole. Do you have ideas for cool Gears that make the Web better? Let us know!.