4 ms·
If those commands are so simple, why are they not built into chrome? Honest question. It's where I actually write my emails.
by duaneb 11y ago
If those commands are so simple, why are they not built into chrome? Honest question. It's where I actually write my emails.
- Freak_NL 11y agoIf a browser provides an OpenPGP API, than how would I know whether or not a website uses it properly? What is to stop a compromised webmail provider from serving me a web page that claims to use this API to encrypt my message before sending it, but also simply sends the plain text message captured from the mail composition page along? You are typing your sensitive message right there in the browser, in the web page provided by them, with JavaScript provided by them, which can simply send whatever you type directly to their (compromised) server. This means OpenPGP in the browser is technically feasible, but very insecure because a third party can access the data before it is encrypted. To make a browser provided OpenPGP API work, it would have to provide the input area where you type your confidential message in a way that makes it clear it is the browser that provides it, and the web page JavaScript cannot access it before encryption. This is of course exactly what stand-alone e-mail clients do, so why implement it in the browser?