3 ms·
This is exactly what gpg-agent is for. Browsers should talk to a locally running gpg-agent, then it would automatically get support for things like OpenPGP smar
by mike-cardwell 12y ago
This is exactly what gpg-agent is for. Browsers should talk to a locally running gpg-agent, then it would automatically get support for things like OpenPGP smart cards. Then you don't even need to trust your OS with access to your keys, let alone your browser.
- lifeisstillgood 12y agoThis sounds so obvious yet I cannot find anything on the Blue Googles about anyone even trying. But yes, obviously. (https://blog.mozilla.org/security/2013/02/13/using-cryptostick-as-an-hsm/ https://blog.mozilla.org/security/2013/02/13/using-cryptosti... close ... so close)
- ultramancool 12y agoMailvelope could potentially use a plugin to do this locally, though it may complicate things.
- elehack 12y agoIIRC, the gpg-agent is sadly not that capable or intelligent. In theory, it should be usable for this. In practice, I believe the agent actually just retrieves the passphrase and hands it to the requesting program, which is then responsible for actually working with the private key. So it doesn't keep your keys safely out of the hands of 'normal' programs, even though it seems like it should. Although it is somewhat confusing, and gpg-agent seems to mediate access to smartcards. Protocol docs here: https://www.gnupg.org/documentation/manuals/gnupg/Agent-Protocol.html https://www.gnupg.org/documentation/manuals/gnupg/Agent-Prot... The ssh-agent, on the other hand, does keep the key material out of the ssh client executable.