3 ms·
But you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key. "Don't have access" is
by e12e 3y ago
But you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key.
"Don't have access" is a little too strongly worded IMNHO.
(I understand the reasoning - and I don't necessarily think it's bad - I just think it overpromises a bit)
- twiss 3y agoSure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922 https://news.ycombinator.com/item?id=36643922.
- cuteboy19 3y agoThe app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about
- e12e 3y agoSending signed and encrypted emails is worse than just reading.