3 ms·
All encryption runs clientside. The whole point of end-to-end is that you don't have to care about who the message passes through. Your actual worries at this
by magicalist 12y ago
All encryption runs clientside. The whole point of end-to-end is that you don't have to care about who the message passes through.
Your actual worries at this point are the key exchange (impersonation) and extension distribution.
The first is very hard to get right without alienating a large number of potential users, the second seems perfectly possible to have verified but seems like it's going to require some kind of changes in the Chrome extension system.
- m-app 12y agoIt doesn't have to pass through anything but if the '/addNSAbackdoor.sh' script just adds a routine to the code that adds the Public Key of an NSA owned key-pair before the encryption process, then the NSA can pick it up from any Internet-tap they have and decrypt it.
- pionar 12y agoExcept that this runs locally, so if you're worried about that, you can build it yourself.