4 ms·
> it's fatal to security I'll respectfully disagree. > But that made your life too hard! So you abandoned that idea We haven't abandoned the Chrome extension
by dcposch 13y ago
> it's fatal to security
I'll respectfully disagree.
> But that made your life too hard! So you abandoned that idea
We haven't abandoned the Chrome extension idea at all. We just think there's a better approach than "packaging the whole application as a Chrome extension". Doesn't sound like you read my reply.
- tptacek 13y agoYou (a) don't have a Chrome extension that verifies anything right now, (b) are currently publishing the pure- browser- JS version of your application, and (c) envision a future in which a small number of "power users" can "safely" use the system while the majority of users, who you correctly note will not install your extension, will be at the mercy of attackers or, for that matter, your own server. You're essentially asking to be the next Lavabit. You've added a verification component that probably won't work even for the verifiers. But that doesn't even matter, because the majority of your users won't even be doing that verification.