41–50 of 96 posts
> or use the official server (that is running an exact copy of this repo)
I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.
> or use the official server (that is running an exact copy of this repo) Is there any project that attempts to prove claims like this? I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.
Either way, I added that line to the readme so readers could easily test the project.
> or use the official server (that is running an exact copy of this repo) Is there any project that attempts to prove claims like this? I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.
> or use the official server (that is running an exact copy of this repo) Is there any project that attempts to prove claims like this? I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.
That is something I already though about but never found anything about it on the Internet, or any discussion that might lead to a way of solving that problem. It might be an interesting project. Either way, I added that line to the readme so readers could easily test the project.
> or use the official server (that is running an exact copy of this repo) Is there any project that attempts to prove claims like this? I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.
(In open source software the solution to this problem is "well, you could always just host your own instance" ;))
The weakest link I can identify here is MITM attacks when you're sending the link. Imagine: Alice generates a link. Sends the link to Bob over an unencrypted/unauthenticated link. Mallory intercepts the link. Generates his own link and send that link to bob. Bob enters the confidential information on Mallory's link. Mallory sees the confidential information, and then sends it to Alice's original link. The only way to…
>But if you already have a secure channel - what's the use case? You can use Whatsapp, or some other E2E-encrypted service that is easy to use, and then transmit the sensitive data over encrypted email, which is more convenient for long-form text.
The weakest link I can identify here is MITM attacks when you're sending the link. Imagine: Alice generates a link. Sends the link to Bob over an unencrypted/unauthenticated link. Mallory intercepts the link. Generates his own link and send that link to bob. Bob enters the confidential information on Mallory's link. Mallory sees the confidential information, and then sends it to Alice's original link. The only way to…
A contact form that is hosted on a HTTPS protected website already does the job. The main difference is that it is usually (but not necessarily) only transmitted encrypted, not stored in encrypted form. Here's a tip: If you generate an email from the content of the contact form anyway, why not make it an encrypted mail? It's rather easy if you use mailx from the heirloom-mailx package that is part of Debian, Ubuntu a…
That's still vulnerable to coldboot style attacks. If the data is never unencrypted unless you're readining it that's technically safer. But yes you are right that would work as well.
js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
I've written a Firefox plugin [0] that checks hardcoded hashes (which can of course only work if the code doesn't change often) and a not-yet-published Chrome plugin that checks the source against the version on GitHub (which requires you to trust that either the webserver or GitHub will not be compromised). @chomponthis: hit me up if you want to work on making either or both plugins work for HawkPost, email in profi…
note: I also have been contributing to hawkpost.