1. Pwnd the servers. 2. Replace nice in-browser crypto Javascript with a bad version that captures and logs the passphrase and any emails you write. 3. Collect

1. Pwnd the servers. 2. Replace nice in-browser crypto Javascript with a bad version that captures and logs the passphrase and any emails you write. 3. Collect your bounty whenever a user logs in. In order not to have to wait for users to log in to the now compromised service and capture their keys, don't actually encrypt newly incoming email anymore. So once I compromise the service I therefore get immediate access to all newly arriving email 100% of the time, and to any already stored user's email if the user ever logs in again, all without breaking/brute-forcing any crypto.