3 ms·
That shouldn't matter much here, as long as the underlying crypto is fine, baring any very bad exploits in the message pack library, any manipulated message sho
by zaarn 6y ago
That shouldn't matter much here, as long as the underlying crypto is fine, baring any very bad exploits in the message pack library, any manipulated message should fail authentication.
- tatersolid 6y agoThey memory safety and type safety of the messagepack library do matter I think: as with PGP, there’s nothing to stop a bad guy from obtaining your public key and sending you encrypted messages. In fact, distribution of public keys is encouraged.
- zaarn 6y agoUnlike PGP, this library is interfaced with a FFI interface or you can write your own lib without too much effort. PGP requires understanding it's stdio RPC format. That is the source of some issues related to malicious messages. And of course that PGP doesn't much care where it finds them. The later very much depends on the email client but the former is less of an issue. In a worst case using this, you'll be looking at a crash in your client. Code execution is an unlikely issue in Go. The lib doesn't care much about the inside format of the message so that should be a non-issue as well. I think PGP just gave this sort of messaging format a bad rep because PGP has a bunch of issues related to "being able to cleanly decrypt and encrypt a message".