Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenPGPjs has passed an independent security audit

protonmail.com

Post reply on HN
Print view View original

41–50 of 128 posts

Re: OpenPGPjs has passed an independent security audit

#41

Post by eeZah7Ux »

eeZah7Ux wrote: post #17
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

...not to mention the huge attack surface of browsers in general. And also how the same application you are using to encrypt your mail is also running javascript from random sources when you browse websites.

...and why all the downvotes? Interestingly, if I write from other accounts I don't get all this downvoting.

Re: OpenPGPjs has passed an independent security audit

#42

Post by tlrobinson »

jnbiche wrote: post #24
phaer wrote: post #12

Earlier quoted context omitted.

No, because the provider would be in the position to change the SRI hashes. Sub Resource Integrity protects you against malicious CDNs and so on, but needs a non-compromised HTML page to provide correct hashes. You could however probably provide a signed entry point via a webextension or so and a an audit trail via a trusted distribution plattform, like addons.mozilla.org. Are there apps which use a mechanism like th…

There was a way to make a permanent site installation on most browsers using HTML5 appcache, which even the web host couldn't update, but that API is deprecated in favor of the service worker's Cache API. It's not clear to me that the Cache API offers the same level of security guarantee.

> It's not clear to me that the Cache API offers the same level of security guarantee.

Last I checked it seemed there wasn’t any way to prevent the service worker itself from being updated.

Re: OpenPGPjs has passed an independent security audit

#44

Post by rasengan »

prophesi wrote: post #16
krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

Please, that's not a verified claim[0], and you shouldn't trust any VPN service that isn't operated by you in the first place. [0]: Plus, it was raised by a competitor, Private Internet Access, so it makes it even more difficult to get the facts straight.

> it was raised by a competitor, Private Internet Access

Focus on the facts. Not the messenger. Secondly, I admire your love of this discussion [1].

[1] https://news.ycombinator.com/item?id=17497912

Re: OpenPGPjs has passed an independent security audit

#45

Post by amaccuish »

driverdan wrote: post #26
amaccuish wrote: post #5

Earlier quoted context omitted.

Yupp. My account at a particular website was terminated. They pointed to their TOS, where "anonymous" address are not allowed. Wasn't even given the chance to keep the account and change the email to an "acceptable" one.

What service? Name and shame.

Not gonna reveal as it's got to do with my private life :p

Re: OpenPGPjs has passed an independent security audit

#46

Post by cdubzzz »

Sir_Cmpwn wrote: post #34
bastawhiz wrote: post #27

Earlier quoted context omitted.

The readme indicates that it can be installed via npm, so I'm not sure what your concern is. https://github.com/openpgpjs/openpgpjs/blob/master/README.md

That doesn't have anything to do with what I said.

To be fair, what you said is only tangentially related to the posted article anyway. It is about a security audit of the OpenPGPjs library (what bastawhiz commented about), not how ProtonMail implements it (what you commented about).

Re: OpenPGPjs has passed an independent security audit

#47

Post by peterwwillis »

woranl wrote: post #14
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

The same can be said for any software that auto update (i.e. Chrome), no?

Attack vectors for replacing Chrome:

  - Hack Google
Attack vectors for replacing OpenPGPjs:

  - Hack the servers hosting OpenPGPjs
  - Hack the browser to inject or replace content across domains, sandboxes, other security barriers
It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications.

Another way to think of it is if your entire Linux OS were actually just web apps with GUIs. Every time you run 'bash', it was actually downloaded from a remote server. And every time you used bash, and it used some plug-in which was hosted on some other site, that plug-in could be compromised, and could be trying to attack your OS, which if successful, would compromise your entire host.

That doesn't happen right now because all the apps sit on your host, aren't constantly re-acquired, aren't constantly subject to potential 3rd party attacks over a wide surface area. Though this does sort-of happen with programming language package managers like npm, pip and so on. But you can pin those versions and hashes if you're paranoid, which I don't think you can do with a browser.

Re: OpenPGPjs has passed an independent security audit

#48

Post by [deleted] »

prophesi wrote: post #16
krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

Please, that's not a verified claim[0], and you shouldn't trust any VPN service that isn't operated by you in the first place. [0]: Plus, it was raised by a competitor, Private Internet Access, so it makes it even more difficult to get the facts straight.

[deleted]

Re: OpenPGPjs has passed an independent security audit

#49

Post by LeoPanthera »

Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

I don't know if Protonmail do this or not, but presumably you could supply the javascript part of your web application as a browser plugin, which would render it immune to attacks on the server.

Re: OpenPGPjs has passed an independent security audit

#50

Post by ltc5505 »

close04 wrote: post #39
krn wrote: post #28

Earlier quoted context omitted.

> Please, that's not a verified claim[0], and you shouldn't trust any VPN service that isn't operated by you in the first place. The co-founders of ProtonMail were caught providing multiple inaccurate statements about their business practices in that thread, and couldn't deny any of the facts stated by the co-founder of PIA[1]. [1] https://news.ycombinator.com/item?id=17262566

Which part of the world should any service be provided from to be trustworthy? Let me rephrase, which services are known to have never cooperated with any agency, nor ever being hacked by them?

... Facebook
Post reply on HN