4 ms·
If your browser is untrusted, you are doomed. > Furthermore, this helps against content disclosure if the server is compromised. If the server is compromised,
by fooyc 13y ago
If your browser is untrusted, you are doomed.
> Furthermore, this helps against content disclosure if the server is compromised.
If the server is compromised, openpgp.js is compromised too.
- willvarfar 13y agoPresuming the private key for the messages is not on the server, then old messages will not be compromised. A kind of perfect secrecy for messages.
- fooyc 13y agoNo need to do this on the client side then (that was my point)
- willvarfar 13y agoYou could do the exact same thing on the server, but that's using server's CPU instead of clients?
- manojlds 13y agoForward secrecy with https? https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy https://community.qualys.com/blogs/securitylabs/2013/08/05/c...
- willvarfar 13y agoyeah its often called perfect forward secrecy - PFS - too. http://en.wikipedia.org/wiki/Perfect_forward_secrecy http://en.wikipedia.org/wiki/Perfect_forward_secrecy