11–20 of 96 posts
$ echo "Hello world" > message.txt gpg --sign message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith " $ echo "evil" > message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith "
How is this different from e2e-encrypted webchat?
$ echo "Hello world" > message.txt gpg --sign message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith " $ echo "evil" > message.txt $ gpg --verify message.txt.gpg gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E gpg: Good signature from "John Smith "
I don't think I'm smart enough to infer what you're trying to say. Care to elaborate?
Earlier quoted context omitted.
Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?
What about SRI? "Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match." [0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Earlier quoted context omitted.
I don't think I'm smart enough to infer what you're trying to say. Care to elaborate?
He's saying that, even though he changed the message, the signature still validated. He doesn't realize that the resulting GPG file contains the message, so it's verifying it against its own, stored copy.
Sounds like a UX problem than a technical one. It's equivalent to me zipping up a folder, changing the contents of that folder, then expecting the zip file to have the change as well.
js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
@chomponthis: hit me up if you want to work on making either or both plugins work for HawkPost, email in profile.
A complete in-browser RSA encrypted message sharing for one-time use. Like transferring passwords via unsecure channels (aka Skype).
It generates a keypair in the browser (offline) and guides also unexperienced users through the process. Frankly, its a dirty hack, but it does the job haha.
Except for the message signing and auto-emailing, I've implemented something similar:
Blogpost: https://0day.work/easy-pgp-composer-encrypting-pgp-messages-...