3 ms·
> Who stores my private key? Google? Chrome? Both seem troublesome If you use the OpenPGP plugin for Roundcube, you paste your key into a form on the settings
by mike-cardwell 13y ago
> Who stores my private key? Google? Chrome? Both seem troublesome
If you use the OpenPGP plugin for Roundcube, you paste your key into a form on the settings page whilst logged in, and it gets stored in your browsers localStorage (never sent to the server). Of course, with this system, the key needs to be managed externally and pasted into each browser you use, and you need to trust that the server doesn't send modified JS which steals your key.
To make it so you don't have to manage the keypair externally, it could be sent to the server after being encrypted using a password, then whenever you need to use a new browser, it will retrieve the encrypted key from the server, decrypt it with your supplied password and then store it in localStorage. Or perhaps it should remain encrypted when in localStorage, and when you log in, retrieved from localStorage, decrypted with a supplied password and then stored in a global variable.
Javascript crypto in the browser works... until the person running the server decides to steal your key when you log in, or until somebody finds an XSS flaw in the app.
- deleted 13y ago[deleted]
- Lx1oG-AWb6h_ZG0 13y agoWhy can't the browser do the crypto on your input, before it even gets to the site/js? (e.g., expose a secure input and output API (say, a new type of HTML textarea and markup tag). Whenever you start entering text, or when a secure element enters the viewport, look up the key for the site (stored locally, like how they remember passwords) and encrypt/decrypt the content. All the site/js sees is gibberish.
- rcxdude 13y agoYou will also need a mechanism for marking the input as secure which can't be duplicated by a malicious webpage.
- mike-cardwell 13y agoIt could. But it hasn't been done yet. And as rcxdude stated, it would need to be done in such a way that you can't create a fake secure textarea using HTML. Perhaps when focusing on one, all other script on the page stops, no events or timeouts are triggered, everything other than the secure textarea is ghosted out, and something big and obvious in the browsers chrome lights up to show you that you are actually focused on a "secure textarea" and not a normal one.
- derefr 13y agoThat sounds more like it should be a separate window/tab/sheet of browser chrome.