3 ms·

This is the most likely attack vector for any automatically updating program on your computer, not just End-to-End. What would stop a maliciously updated Chrom

This is the most likely attack vector for any automatically updating program on your computer, not just End-to-End. What would stop a maliciously updated Chrome from recording all your keystrokes in the browser [all of your password; passphrases] as well as copying where you were at the time? Etc. This is one of those things where if you think the Government is going to silence you for being a dissenting voice and/or steal your info because of it...you grab an open source project, you compile it, you use that. You don't grab closed source software that automagically updates. I don't think its reasonable to expect Google to protect the user from -every- potential attack vector.

simias 12y ago
I think the reason many people (including myself) have a certain reticence to this google made crypto-in-the-browser is that nowadays I feel the #1 reason to use such an extension would be to protect ourselves from eavesdropping from Google or the government. So basically you're trusting Google for giving you the tools to escape Google's scrutiny, knowing full well that if they really want to access your messages they can easily backdoor your crypto extension. So what's the point? To me it's just homeopathic crypto.
- raldi 12y ago
  You have access to all the code and can read it and compile it yourself, and then turn off automatic updating. And if you're not tech-savvy enough to do that, you can hire someone else to. And if even that's not enough to please you, then tell me, what could possibly satisfy you?
  - simias 12y ago
    Use a third party tool instead of putting all your trust into a single point of failure. There are plenty to choose from. What you're proposing is pretty complex and time consuming, you can't expect the average user of this extension to do that (I know I wouldn't). Or alternatively decide that you're fine with trusting google with whatever info is in your emails because you believe they have to much to lose if they're caught eavesdropping on some random Joe like me. That's what I do. And if tomorrow I feel I have a mail sensitive enough that I don't want to risk Google or some government intercepting it I certainly won't do it from my web browser's using Google's own extension.
    - raldi 12y ago
      How does using a third-party tool solve anything? Its code probably won't have as many skilled eyeballs reviewing it.
      - simias 12y ago
        Maybe, maybe not, GnuPG has been here a long time already for instance. But that's not the point anyway, the point is that Google can update your browser and the extension without you being aware of it very easily. You can turn it off of course, but who does that? Running an outdated browser is not exactly the best security measure...

simias 12y ago

I think the reason many people (including myself) have a certain reticence to this google made crypto-in-the-browser is that nowadays I feel the #1 reason to use such an extension would be to protect ourselves from eavesdropping from Google or the government. So basically you're trusting Google for giving you the tools to escape Google's scrutiny, knowing full well that if they really want to access your messages they can easily backdoor your crypto extension. So what's the point? To me it's just homeopathic crypto.

raldi 12y ago
You have access to all the code and can read it and compile it yourself, and then turn off automatic updating. And if you're not tech-savvy enough to do that, you can hire someone else to. And if even that's not enough to please you, then tell me, what could possibly satisfy you?
- simias 12y ago
  Use a third party tool instead of putting all your trust into a single point of failure. There are plenty to choose from. What you're proposing is pretty complex and time consuming, you can't expect the average user of this extension to do that (I know I wouldn't). Or alternatively decide that you're fine with trusting google with whatever info is in your emails because you believe they have to much to lose if they're caught eavesdropping on some random Joe like me. That's what I do. And if tomorrow I feel I have a mail sensitive enough that I don't want to risk Google or some government intercepting it I certainly won't do it from my web browser's using Google's own extension.
  - raldi 12y ago
    How does using a third-party tool solve anything? Its code probably won't have as many skilled eyeballs reviewing it.
    - simias 12y ago
      Maybe, maybe not, GnuPG has been here a long time already for instance. But that's not the point anyway, the point is that Google can update your browser and the extension without you being aware of it very easily. You can turn it off of course, but who does that? Running an outdated browser is not exactly the best security measure...