4 ms·
> [Alice knows] no one (other than Eve) can spoof Bob's identity If Carol or Chuck can spoof Eves "identity" they can spoof Bobs identity. This can be done in
by emj 9y ago
> [Alice knows] no one (other than Eve) can spoof Bob's identity
If Carol or Chuck can spoof Eves "identity" they can spoof Bobs identity. This can be done in a multitude of technical or social ways.
Is it better to have this than nothing? The problem is that you have to trust your whole infrastructure if you want to do this kind of client side encrypting.
- dane-pgp 9y agoIf your threat model says that Eve's webmail servers can be spoofed, then Alice can't use webmail at all, or possibly any websites. At that point, the security of PGP in JS is pretty much irrelevant.
- emj 9y agoI think that is one of the most obvious things that can happen, but no it only affects JS PGP that is integrated on a site you use. PGP in JS is still relevant because it makes it easier to download, verify and execute Javascript "anywhere", not as an integrated solution served by a third party. Sadly.