3 ms·
The problem here is that there is no way for the average user to tell if the server itself is serving you client-side code that will actually encrypt your data
by Freak_NL 11y ago
The problem here is that there is no way for the average user to tell if the server itself is serving you client-side code that will actually encrypt your data before sending it to the server. The browser security model explicitly depends on trusting the remote server (whose identity you verified using TLS, and with whom you can communicate securily) with whatever data you enter client-side.
With end-to-end encryption of e-mail, the server is not part of the immediate trust model; it is to act only as a transfer agent. This is why end-to-end e-mail encryption is easy with a dedicated mail user agent (MUA) such as Thunderbird with Enigmail, but awkward with webmail, where you need a third party browser plugin (such as Mailvelope) to provide the encryption step.