Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenPGPjs has passed an independent security audit

protonmail.com

Post reply on HN
Print view View original

11–20 of 128 posts

Re: OpenPGPjs has passed an independent security audit

#11

Post by Sir_Cmpwn »

taf2 wrote: post #6
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

isn't this why https://developer.mozilla.org/en-US/docs/Web/Security/Subres... was invented?

This solves a different problem. Say actor A makes a website and uses CDNs provided by actor B. This protects users from actor B changing their scripts, but not from a malicious actor A. In this case I'm presuming ProtonMail is actor A.

Re: OpenPGPjs has passed an independent security audit

#12

Post by phaer »

taf2 wrote: post #6
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

isn't this why https://developer.mozilla.org/en-US/docs/Web/Security/Subres... was invented?

No, because the provider would be in the position to change the SRI hashes. Sub Resource Integrity protects you against malicious CDNs and so on, but needs a non-compromised HTML page to provide correct hashes.

You could however probably provide a signed entry point via a webextension or so and a an audit trail via a trusted distribution plattform, like addons.mozilla.org. Are there apps which use a mechanism like this?

Re: OpenPGPjs has passed an independent security audit

#13

Post by [deleted] »

amaccuish wrote: post #5
bankspot wrote: post #2

Have any current protonmail users experienced denial of service from online providers solely because of their email address?

Yupp. My account at a particular website was terminated. They pointed to their TOS, where "anonymous" address are not allowed. Wasn't even given the chance to keep the account and change the email to an "acceptable" one.

[deleted]

Re: OpenPGPjs has passed an independent security audit

#14

Post by woranl »

Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

The same can be said for any software that auto update (i.e. Chrome), no?

Re: OpenPGPjs has passed an independent security audit

#15

Post by tlrobinson »

Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

This (rightfully) comes up every time some browser-based encryption tool is posted. It seems like the desire for such tools isn’t going to go away. Is anyone working on solutions for making distribution of JavaScript applications more secure?

There’s a range of assurances you could try to provide, e.x. signatures from the author (or even 3rd parties), prompting for updates, etc. It would likely require support from browsers.

At one point I investigated using service workers to intercept subsequent app updates to check signatures but there was no way to prevent the service worker itself from being replaced (probably because it would be easy for a site to permanently “brick” itself in users browssr).

Re: OpenPGPjs has passed an independent security audit

#16

Post by prophesi »

krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

Please, that's not a verified claim[0], and you shouldn't trust any VPN service that isn't operated by you in the first place.

[0]: Plus, it was raised by a competitor, Private Internet Access, so it makes it even more difficult to get the facts straight.

Re: OpenPGPjs has passed an independent security audit

#17

Post by eeZah7Ux »

Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

...not to mention the huge attack surface of browsers in general.

And also how the same application you are using to encrypt your mail is also running javascript from random sources when you browse websites.

Re: OpenPGPjs has passed an independent security audit

#19

Post by syoc »

krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

I agree that people should read the linked comments. I did not find the the evidence to be as clear cut or damning as OP seems to think at all after reading through it. Most claims are also put forward by a co founder of Private Internet Access. A direct competitor.

Re: OpenPGPjs has passed an independent security audit

#20

Post by Sir_Cmpwn »

woranl wrote: post #14
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

The same can be said for any software that auto update (i.e. Chrome), no?

Yes.
Post reply on HN