4 ms·

X25519 is great, but it doesn’t make Protonmail (really, OpenPGPjs) a net safe communications mechanism. It inherits all of the flaws inherent in OpenPGP, incl

by lvh 8y ago

X25519 is great, but it doesn’t make Protonmail (really, OpenPGPjs) a net safe communications mechanism. It inherits all of the flaws inherent in OpenPGP, including optional authenticators (which lead to EFAIL), kitchen sink bulk protocols complete with negotiation (did you know your public keys specify what algorithms you like?), lack of forward secrecy, repudiability, et cetera. We should stop using RSA. But RSA isn’t what was keeping OpenPGP from being a great secure communications channel. That’s aside from the question if it’s meaningful to say you control your keys if you use OpenPGPjs served up every time by a third party. (I say that being extremely on the PGP apologia side of the scale compared to some of my peers!)

Forbo 8y ago
Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by browser developers or as an add-on.
- lvh 8y ago
  Sure: that’s WebCrypto. The main problem it solves is that you don’t really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of that good crypto, and you still need to do key management. You could do all of this well if WebCrypto was good and you had a WebExtension, or an Electron app, or some other way where you weren’t just going to do whatever the website tells you to do. (That is not a blanket security recommendation in favor of Electron. XSS does not normally get me RCE.)
  - Boulth 8y ago
    Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.
    - lvh 8y ago
      Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
      - Forbo 8y ago
        This thread has been very informative and gives me a lot of reading to look into. Thank you so much!
      - Boulth 8y ago
        Too bad there is nothing like that built into browsers directly. I guess not only security related webapps could take advantage of it.

by lvh 8y ago

Forbo 8y ago

Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by browser developers or as an add-on.

lvh 8y ago
Sure: that’s WebCrypto. The main problem it solves is that you don’t really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of that good crypto, and you still need to do key management. You could do all of this well if WebCrypto was good and you had a WebExtension, or an Electron app, or some other way where you weren’t just going to do whatever the website tells you to do. (That is not a blanket security recommendation in favor of Electron. XSS does not normally get me RCE.)
- Boulth 8y ago
  Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.
  - lvh 8y ago
    Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
    - Forbo 8y ago
      This thread has been very informative and gives me a lot of reading to look into. Thank you so much!
    - Boulth 8y ago
      Too bad there is nothing like that built into browsers directly. I guess not only security related webapps could take advantage of it.