[tixzdk]

I think the article gets this wrong. `window.crypto` should be read-only

[ifelsehow]

I find the following in Chrome:

> window.crypto.getRandomValues

// getRandomValues() { [native code] }

> window.crypto.getRandomValues = function () { return "aloha" }

> window.crypto.getRandomValues()

// "aloha"

Not sure if this is the case in all browsers. `window.crypto` certainly should be read-only.

[niftich]

In Chrome, window.crypto is read-only:

> window.crypto

< Crypto {subtle: SubtleCrypto}

> window.crypto = "hi!"

< "hi!"

> window.crypto

< Crypto {subtle: SubtleCrypto}

But not anything underneath, including getRandomValues(), as you write. A recent issue about this [1] on the WebCrypto spec itself was closed with 'wontfix' because in their view, polyfilling web APIs is a common and accepted practice.

[1] https://github.com/w3c/webcrypto/issues/107

[flukus]

Shouldn't all pollyfills check only override the functions if they're missing?

[jsjohnst]

What if it's present but the implementation is incomplete?

[paulddraper]

E.g. an extra optional parameter.

[rmrfrmrf]

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25345

It looks like they intentionally don't do that in order to prevent the illusion of security.