Javascript and Security

[The_Fire]

Sort of longish:

So in Denmark we have this electronic signature thing called NemId, which makes it possible for us to sign on with the same login information on multiple things like tax records, banking etc. Sensitive stuff in other words.

It does this in two parts: A login/password part and a verification part with a keycard thingy ala the authenticator on Battle.net.

Now the current solution are based on Java, and aside from the debacle last week in connection with the latest update, have been working ok, as long as you remeber to update your java when it asks for it. No sweat, even my 70+ year old dad can figure that out. However.....

As said, last week there was a breakdown lasting from wednesday to friday where the thing didn't work due to a java update. Bank rolled out an emergency solution, but anything Mac or taxes/union etc. were scewed.

After they got NemId up and running again, some hotshot at the place administering the solution (nets), commented that they were rolling out a new solution next year on a different platform and that all these problems would then be over with.

The platform? JavaScript.

At which point my "its too late in the night to go to bed, so I'll chug tea and stay awake instead" brew went all over my keyboard.
Vocally I think there are dogs that are now deaf from the "ARE THEY NUTS?!!!!" that automaticly spewed out.

During my training (both bouts of it) as a webintegrator, JavaScript have continually been described as "Ok for stuff that you dont mind others seeing but dont use it for stuff you dont want all over the internet or deals with your secure data like logins and stuff". And this is where you lot comes in.

Is there something I have missed? Seriously, Javascript for whats basically the key for every personal information needed for identy theft and seriously screwing my life over?

Help me out: What am I missing?

 

[PhantomWolf]

Sort of longish:

So in Denmark we have this electronic signature thing called NemId, which makes it possible for us to sign on with the same login information on multiple things like tax records, banking etc. Sensitive stuff in other words.

It does this in two parts: A login/password part and a verification part with a keycard thingy ala the authenticator on Battle.net.

Now the current solution are based on Java, and aside from the debacle last week in connection with the latest update, have been working ok, as long as you remeber to update your java when it asks for it. No sweat, even my 70+ year old dad can figure that out. However.....

As said, last week there was a breakdown lasting from wednesday to friday where the thing didn't work due to a java update. Bank rolled out an emergency solution, but anything Mac or taxes/union etc. were scewed.

After they got NemId up and running again, some hotshot at the place administering the solution (nets), commented that they were rolling out a new solution next year on a different platform and that all these problems would then be over with.

The platform? JavaScript.

At which point my "its too late in the night to go to bed, so I'll chug tea and stay awake instead" brew went all over my keyboard.
Vocally I think there are dogs that are now deaf from the "ARE THEY NUTS?!!!!" that automaticly spewed out.

During my training (both bouts of it) as a webintegrator, JavaScript have continually been described as "Ok for stuff that you dont mind others seeing but dont use it for stuff you dont want all over the internet or deals with your secure data like logins and stuff". And this is where you lot comes in.

Is there something I have missed? Seriously, Javascript for whats basically the key for every personal information needed for identy theft and seriously screwing my life over?

Help me out: What am I missing?

Depends if they are planning to run it client-side or server-side. If they are running it client-side then they might be planning to use JQuery and AJAX to pull and manipulate data from the server that no one else gets to see. That might help a little bit, but I'd still be a little sus. If it's going to be used server side with ASP, then it's generally safe unless someone gets into the server and downloads the code, and even Java is vulnerable to that.

I know my bank does stuff with AJAX and JQUERY with their online banking, but not sure what, just seen them asking for those skills when advertising developer positions.