4 ms·

I think key management is a really big problem, as I say in my blog post 'I shouldn’t be trusted with anything as precious as my own private key'. http://kyber

I think key management is a really big problem, as I say in my blog post 'I shouldn’t be trusted with anything as precious as my own private key'. http://kybernetikos.com/2013/06/22/how-do-we-make-encryption-more-accessible/ http://kybernetikos.com/2013/06/22/how-do-we-make-encryption... I'm not so sure about the problems with webmail. I don't see why they would be significantly different from the problems associated with serving a web banking site, and there are plenty of those.

zokier 13y ago
> I don't see why they would be significantly different from the problems associated with serving a web banking site, and there are plenty of those. With web banking usually the bank has legitimately access to all information they are presenting to you via web. In email your email-provider shouldn't have access to your unencrypted mail.
- Retric 13y ago
  Presumably you could use client site JavaScript to decode your message. However, that brings up key management issues.
  - zokier 13y ago
    I don't believe that would be good enough. Encryption/decryption should be done by the browser in a way that JS has no access to either the keys or the cleartext. There should be also clear indications in the browser chrome when accessing such elements.
- kybernetikos 13y ago
  I suppose the key point is that you can't trust whomever is storing your data with storing your email app code - it's far too easy for them to serve you backdoored app code if they're required to by the government.
adestefan 13y ago
Key management is usually the biggest issue when it comes to any crypto scheme. It's a problem with so many weird corner cases that anytime someone things they have a good idea there's always that "Oh shit" moment when they realize it won't work or it's way too complicated.

4 ms·

I think key management is a really big problem, as I say in my blog post 'I shouldn’t be trusted with anything as precious as my own private key'. http://kyber

by kybernetikos 13y ago

zokier 13y ago
> I don't see why they would be significantly different from the problems associated with serving a web banking site, and there are plenty of those. With web banking usually the bank has legitimately access to all information they are presenting to you via web. In email your email-provider shouldn't have access to your unencrypted mail.
- Retric 13y ago
  Presumably you could use client site JavaScript to decode your message. However, that brings up key management issues.
  - zokier 13y ago
    I don't believe that would be good enough. Encryption/decryption should be done by the browser in a way that JS has no access to either the keys or the cleartext. There should be also clear indications in the browser chrome when accessing such elements.
- kybernetikos 13y ago
  I suppose the key point is that you can't trust whomever is storing your data with storing your email app code - it's far too easy for them to serve you backdoored app code if they're required to by the government.
adestefan 13y ago
Key management is usually the biggest issue when it comes to any crypto scheme. It's a problem with so many weird corner cases that anytime someone things they have a good idea there's always that "Oh shit" moment when they realize it won't work or it's way too complicated.