4 ms·
It's still not ready for production use. One problem with e2e is that it's JavaScript based and runs in he browser, so there is a certain attack vector present
by darkr 11y ago
It's still not ready for production use. One problem with e2e is that it's JavaScript based and runs in he browser, so there is a certain attack vector present there. To defend against this, ideally e2e needs to work with a smartcard (such as the yubikey neo) so that the private key cannot be stolen.
There was an issue I was tracking a while back to integrate this support, but it's still a work in progress.
- viraptor 11y agoIt doesn't even need the hardware part in most cases. OS keyrings support pkcs11 interface with signing exposed. That means you can just send data to be encrypted for example by gnome-keyring and the browser never sees the actual key.
- darkr 11y agoBut e2e doesn't use the OS keyring. It uses it's own JavaScript keyring that runs in the browser and uses localstorage for storing private keys.