title: Can Mylar be hacked?
body: <p>I'm interested in using <a href="http://css.csail.mit.edu/mylar/" rel="nofollow">Mylar</a> for an upcoming project. </p>
  
  <p>The promises that Mylar makes seem impressive. However, could a dev write a back-door attack into the code, that is allowed to run (verified by hash/signature), so that the data is compromised (likely via XSS)? Mylar documentation states: </p>
  
  <blockquote>
    <p>"Mylar ensures that client-side application code is authentic, even if
    the server is malicious."</p>
  </blockquote>
  
  <p>The only way I can imagine this being protected against is for the browser itself to disallow outbound communication of unencrypted data. But, for that to happen, how can the app query the database, make calls back to the server (I understand that Mylar is best used with a browser side framework like Meteor, but still, Meteor needs to communicate with the server for certain tasks).</p>
  
  <p>Is Mylar able to provide complete data security, even from the application developer/server admin?</p>
  
  <p>Here is Mylar's claim (from <a href="http://www.mit.edu/~ralucap/mylar.pdf" rel="nofollow">http://www.mit.edu/~ralucap/mylar.pdf</a>):</p>
  
  <blockquote>
    <p>3.4 Threat model</p>
    
    <p><strong>Threats.</strong> Both the application and the database servers can be fully controlled by an adversary: the adversary may obtain all data
    from the server, cause the server to send arbitrary responses to web
    browsers, etc. This model subsumes a wide range of real-world security
    problems, from bugs in server software to insider attacks. Mylar also
    allows some user machines to be controlled by the adversary, and to
    collude with the server. This may be either because the adversary is a
    user of the application, or because the adversary broke into a user’s
    machine. We call this adversary active, in contrast to a passive
    adversary that eavesdrops on all information at the server, but does
    not make any changes, so that the server responds to all client
    requests as if it were not compromised.</p>
    
    <p><strong>Guarantees.</strong> Mylar protects a data item’s confidentiality in the face of arbitrary server compromises, as long as none of the users
    with access to that data item use a compromised machine.</p>
  </blockquote>
  
  <p>In this context, 'compromised machine' means the client machine/browser.</p>
  
  <hr>
  
  <p>After re-reading the <a href="http://www.mit.edu/~ralucap/mylar.pdf" rel="nofollow">Mylar white paper</a>, I see where the document states:</p>
  
  <blockquote>
    <p><strong>Assumptions.</strong> To provide the above guarantees, Mylar makes the
    following assumptions. Mylar assumes that the web application as
    written by the developer will not send user data or keys to
    untrustworthy recipients, <em>and cannot be tricked into doing so by
    exploiting bugs (e.g., cross-site scripting)</em>. Our prototype of Mylar
    is built on top of Meteor, a framework that helps programmers avoid
    many common classes of bugs in practice.</p>
  </blockquote>
  
  <p>Does this mean the way the application was written at the time of encryption, or at the time of attack? In other words, is the encrypted data somehow tied to a specific version of the application code? Elsewhere in the <a href="http://www.mit.edu/~ralucap/mylar.pdf" rel="nofollow">referenced Mylar white paper</a> it indicates that the app code is verified against a hash signature. </p>
  
  <p>If the app code can simply be hacked at the server, this reduces the value proposition greatly, as any attacker who gains access to the source code could modify the code and leach data as it is requested (at the browser). The Guarantee of "protecting confidentiality in the face of arbitrary server compromises" seems broad enough to include the idea of the attacker modifying the source code of the application, hence my confusion.</p>
  
  <hr>
  
  <p>Also refer to section 6 in the white paper for more information. I believe the Mylar doc is conveying that it does mitigate compromised application code attacks. I'd really love to hear from a dev with authoritative understanding of Mylar.</p>