5 ms·

You shouldn't do it in a web browser at all, client or server side. They can start off doing it client side and then silently switch to doing it server side. I'

You shouldn't do it in a web browser at all, client or server side. They can start off doing it client side and then silently switch to doing it server side. I've admittedly never used PGP, but I would think if a website at any point has access to your private key and could transmit it back to their server, you're doing it wrong. I suppose it's a question of your threat model. Do you trust the website to not do that? Given that FBI is willing to take over and continue operating websites that distribute child porn, the default answer to that question ought to be no. You have no way of knowing if someone else has taken a server over. Maybe a browser extension would be a good way to do PGP encryption for websites, keeping the key out of their reach but allowing a one-click encryption right in the browser.

vilhelm_s 9y ago
Indeed, it's common advice that users of Darknet markets should not have Javascript turned on at all, since it increases their attack surface. (e.g. https://darknetmarkets.org/agora-comments-on-recent-bitcoin-stealing-private-message-javascript-attack/ https://darknetmarkets.org/agora-comments-on-recent-bitcoin-...)
- stingraycharles 9y ago
  Isnt that the default of the Tor browser as well ?
  - 4ad 9y ago
    No, it isn't, which is insane.
    - dmix 9y ago
      Yes it is. It wasn't for the first couple years but they turned it on a few yrs back. Last time I used Tor browser JS was disabled by default... I'd be surprised if that wasn't the case.
      - 4ad 9y ago
        No, it isn't. I just downloaded the latest version of the Tor Browser, 7.5, and while it comes with NoScript installed, it's turned off by default: https://i.imgur.com/7pb7nvI.png https://i.imgur.com/7pb7nvI.png
        mirimir 9y ago
        That's been a contentious point for years. The dominant faction of Tor devs fears that Javascript blocking will confuse and frustrate too many users. In the kindest interpretation, that's to protect the most users, notwithstanding that it will get some users pwned. Less kindly, one could argue that Tor devs want to increase the anonymity set, in order to better hide US government users. That was, after all, one reason why Tor's initial Navy funders agreed with open release of the software. There are similar issues around other Tor vulnerabilities. Such as how easy it is for apps to bypass Tor. Which has allowed the FBI's phone-home malware to pwn users.
        TomMarius 9y ago
        Could you please tell me more about the other Tor vulnerabilities?
        mirimir 9y ago
        I'm not aware of known vulnerabilities in Tor itself that devs haven't mitigated, out of usability concerns or whatever. Generally, I consider the focus on Windows users, and the reliance on tweaking Firefox for security, to be vulnerabilities. Also the refusal to compartmentalize the Tor process from userland, either in VMs or in separate hardware. I mean, Whonix has been around for years, and it's not featured (or even mentioned, unless you dig into the wiki) on the Tor Project website. And what about Qubes? Or Tor routers? I mean, they go after people for calling them that, citing their copyright.
        crtasm 9y ago
        https://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tails-36-out https://blog.torproject.org/tails-36-out But I fully agree the main site should make the risks of TBB clearer and promote Whonix/similar.
- s73v3r_ 9y ago
  I like how that's a .org. They really do just want to get the information out there.
deleted 9y ago
[deleted]
cookiecaper 9y ago
Extensions get exploited from inside the browser too. If you're going to be buying contraband online, one would hope that you have at least enough commitment to move your mouse over to another window on your desktop and do the cryptography there.
bdhess 9y ago
> I've admittedly never used PGP, but I would think if a website at any point has access to your private key and could transmit it back to their server, you're doing it wrong. Encrypting a confidential message for another party is a public key operation. It’s the fact that the plaintext was sent to a remote server that’s problematic.
- wlesieutre 9y ago
  Oh right, good catch. So the problem is that encrypted messaging on a webpage just can't be convenient like messaging on facebook if you want to keep the server from having your messages. Other people send you messages, and you'll need to decrypt them yourself outside of the browser if you want to keep the browser from having your private key.

vilhelm_s 9y ago

Indeed, it's common advice that users of Darknet markets should not have Javascript turned on at all, since it increases their attack surface. (e.g. https://darknetmarkets.org/agora-comments-on-recent-bitcoin-stealing-private-message-javascript-attack/ https://darknetmarkets.org/agora-comments-on-recent-bitcoin-...)

stingraycharles 9y ago
Isnt that the default of the Tor browser as well ?
- 4ad 9y ago
  No, it isn't, which is insane.
  - dmix 9y ago
    Yes it is. It wasn't for the first couple years but they turned it on a few yrs back. Last time I used Tor browser JS was disabled by default... I'd be surprised if that wasn't the case.
    - 4ad 9y ago
      No, it isn't. I just downloaded the latest version of the Tor Browser, 7.5, and while it comes with NoScript installed, it's turned off by default: https://i.imgur.com/7pb7nvI.png https://i.imgur.com/7pb7nvI.png
      - mirimir 9y ago
        That's been a contentious point for years. The dominant faction of Tor devs fears that Javascript blocking will confuse and frustrate too many users. In the kindest interpretation, that's to protect the most users, notwithstanding that it will get some users pwned. Less kindly, one could argue that Tor devs want to increase the anonymity set, in order to better hide US government users. That was, after all, one reason why Tor's initial Navy funders agreed with open release of the software. There are similar issues around other Tor vulnerabilities. Such as how easy it is for apps to bypass Tor. Which has allowed the FBI's phone-home malware to pwn users.
        TomMarius 9y ago
        Could you please tell me more about the other Tor vulnerabilities?
        mirimir 9y ago
        I'm not aware of known vulnerabilities in Tor itself that devs haven't mitigated, out of usability concerns or whatever. Generally, I consider the focus on Windows users, and the reliance on tweaking Firefox for security, to be vulnerabilities. Also the refusal to compartmentalize the Tor process from userland, either in VMs or in separate hardware. I mean, Whonix has been around for years, and it's not featured (or even mentioned, unless you dig into the wiki) on the Tor Project website. And what about Qubes? Or Tor routers? I mean, they go after people for calling them that, citing their copyright.
        crtasm 9y ago
        https://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-qubes-os https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tor-heart-whonix https://blog.torproject.org/tails-36-out https://blog.torproject.org/tails-36-out But I fully agree the main site should make the risks of TBB clearer and promote Whonix/similar.
s73v3r_ 9y ago
I like how that's a .org. They really do just want to get the information out there.

deleted 9y ago

[deleted]

cookiecaper 9y ago

Extensions get exploited from inside the browser too. If you're going to be buying contraband online, one would hope that you have at least enough commitment to move your mouse over to another window on your desktop and do the cryptography there.

bdhess 9y ago

> I've admittedly never used PGP, but I would think if a website at any point has access to your private key and could transmit it back to their server, you're doing it wrong. Encrypting a confidential message for another party is a public key operation. It’s the fact that the plaintext was sent to a remote server that’s problematic.

wlesieutre 9y ago
Oh right, good catch. So the problem is that encrypted messaging on a webpage just can't be convenient like messaging on facebook if you want to keep the server from having your messages. Other people send you messages, and you'll need to decrypt them yourself outside of the browser if you want to keep the browser from having your private key.