4 ms·

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id

Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' + encodeURIComponent($('#id_text').val()))` or similar added to it. Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

t0astbread 7y ago
I feel like this should be a browser extension: Automatically checking resources for changes and blocking new versions until the diff has been approved
- pinehqcom 7y ago
  That's actually not a bad idea. You could add different kinds of auditors and see who approved it. I'll add that to my never-ending list of "Good Business Ideas When I have time"
mattigames 7y ago
There is a way to make sure the website never changes without having to check each time, and that is to append it as a data:text/html link and add such link as a bookmark (example data:text/html,<script>alert('hi');</script>), as long as the script tags have SRI (Subresource Integrity Check[0]) [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
z3t4 7y ago
You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.
- mattigames 7y ago
  you forgot to mention you also need to trust the CPU, the motherboard among other hardware components, you also need to trust lack of cameras on the room you see the message among other physical eavesdropping.
  - jrockway 7y ago
    You also have to trust yourself! Many people have given up their encrypted messages after having a few too many fermented malt beverages!
- deleted 7y ago
  [deleted]
pinehqcom 7y ago
All my JavaScript is self-hosted and easy to read. If you don't trust my service then you can just keep the password in Instapass and the other login info (url to login, email, username, etc..) inside the email. How should I know what you sent a password to? I think that's a better choice than sending login info in clear text.

t0astbread 7y ago

I feel like this should be a browser extension: Automatically checking resources for changes and blocking new versions until the diff has been approved

pinehqcom 7y ago
That's actually not a bad idea. You could add different kinds of auditors and see who approved it. I'll add that to my never-ending list of "Good Business Ideas When I have time"

mattigames 7y ago

There is a way to make sure the website never changes without having to check each time, and that is to append it as a data:text/html link and add such link as a bookmark (example data:text/html,<script>alert('hi');</script>), as long as the script tags have SRI (Subresource Integrity Check[0]) [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

z3t4 7y ago

You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.

mattigames 7y ago
you forgot to mention you also need to trust the CPU, the motherboard among other hardware components, you also need to trust lack of cameras on the room you see the message among other physical eavesdropping.
- jrockway 7y ago
  You also have to trust yourself! Many people have given up their encrypted messages after having a few too many fermented malt beverages!
deleted 7y ago
[deleted]

pinehqcom 7y ago

All my JavaScript is self-hosted and easy to read. If you don't trust my service then you can just keep the password in Instapass and the other login info (url to login, email, username, etc..) inside the email. How should I know what you sent a password to? I think that's a better choice than sending login info in clear text.