3 ms·
Correct, private keys can only be decrypted client-side, the server doesn't have access to the password that they're encrypted with. Otherwise it wouldn't be en
by twiss 3y ago
Correct, private keys can only be decrypted client-side, the server doesn't have access to the password that they're encrypted with. Otherwise it wouldn't be end-to-end encryption, IMO :)
- e12e 3y agoBut you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key. "Don't have access" is a little too strongly worded IMNHO. (I understand the reasoning - and I don't necessarily think it's bad - I just think it overpromises a bit)
- twiss 3y agoSure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922 https://news.ycombinator.com/item?id=36643922.
- cuteboy19 3y agoThe app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about
- e12e 3y agoSending signed and encrypted emails is worse than just reading.