2 ms·
-nod- an attack with full access to chromes address space would grab the password in memory. I'm guessing someone with that sort of threat model isn't using gm
by mh_ 15y ago
-nod- an attack with full access to chromes address space would grab the password in memory.
I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)
- caf 15y agoCould you mitigate that by having a separate process to do the crypto, which the plugin talks to by IPC? The separate process is then the one that prompts for the password. This would also mean you don't have to reenter your password every time.