Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenPGPjs has passed an independent security audit

protonmail.com

Post reply on HN
Print view View original

71–80 of 128 posts

Re: OpenPGPjs has passed an independent security audit

#71

Post by lucideer »

dividuum wrote: post #67
lucideer wrote: post #62

Earlier quoted context omitted.

There was a site posted on HN a while back that had an interesting take on a solution to this: they had a service-worker that checked github.com for the latest version of the app code and itself (along with the standard subresource integrity of course). That description doesn't do the system justice, as to my memory it seemed like a pretty sound system as long as your public repo remains uncompromised. Unfortunately…

Was it this one? https://github.com/airbornio/signed-web-apps

Nope, it wasn't a library, this was a SaaS website running an open source codebase that was browsable on GitHub.

Re: OpenPGPjs has passed an independent security audit

#72

Post by krn »

crankylinuxuser wrote: post #53
rasengan wrote: post #44

Earlier quoted context omitted.

> it was raised by a competitor, Private Internet Access Focus on the facts. Not the messenger. Secondly, I admire your love of this discussion [1]. [1] https://news.ycombinator.com/item?id=17497912

1. You are the user in question that is a co-founder for PIA. 2. You are a direct competitor to Proton* 3. "Messengers", especially in the position of founder of the competitor, have significant bias. 4. You have a fiduciary reason for them to fail. 5. user protonmail has noted significant harassment regarding this issue Im inclined to distrust both of you. I find that your arguments might have merit. But I also see…

> Im inclined to distrust both of you.

It's neither religion, nor politics. It's tech. You don't need to believe in anything you cannot verify yourself. I have checked most of the statements provided by the co-founder of PIA, and found none of them to be false, even if he sometimes crossed the line of a civil discussion.

Re: OpenPGPjs has passed an independent security audit

#73

Post by eganist »

tlrobinson wrote: post #15
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

This (rightfully) comes up every time some browser-based encryption tool is posted. It seems like the desire for such tools isn’t going to go away. Is anyone working on solutions for making distribution of JavaScript applications more secure? There’s a range of assurances you could try to provide, e.x. signatures from the author (or even 3rd parties), prompting for updates, etc. It would likely require support from b…

> At one point I investigated using service workers to intercept subsequent app updates to check signatures but there was no way to prevent the service worker itself from being replaced (probably because it would be easy for a site to permanently “brick” itself in users browssr).

Cyph nailed this back with appcaches, later migrating to service workers (and ultimately got a patent for the solution), but the implementation of the solution itself got an entire protocol canned by one browser (HPKP).

Source: did the talk on it.

Re: OpenPGPjs has passed an independent security audit

#74

Post by eganist »

SahAssar wrote: post #70
tlrobinson wrote: post #15

Earlier quoted context omitted.

This (rightfully) comes up every time some browser-based encryption tool is posted. It seems like the desire for such tools isn’t going to go away. Is anyone working on solutions for making distribution of JavaScript applications more secure? There’s a range of assurances you could try to provide, e.x. signatures from the author (or even 3rd parties), prompting for updates, etc. It would likely require support from b…

This was "solved" by a online crypto tool (can't remember which) that basically did HPKP suicide every 30 minutes and had a service worker that loaded cached assets on failure. So the browser would pin to a key that was deleted within minutes and then all subsequent requests would only go through the service worker until the pin expired.

cyph.com

Re: OpenPGPjs has passed an independent security audit

#75

Post by Something1234 »

SahAssar wrote: post #68
jrruethe wrote: post #63

Earlier quoted context omitted.

These concepts are interesting: https://codegolf.stackexchange.com/questions/18217/javascrip... https://bitbucket.org/geraintluff/caution.js/ The idea is that a long data-uri containing hashes and a small loader function are bookmarked. The loader won't load the corresponding javascript unless the hashes match. The user only needs to verify the javascript once, then they can rely on their bookmark containing the hash…

Isn't that just SRI in a bookmarklet? With SRI you give the browser a hash and if the resource does not match it does not load.

Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server side, meaning you can't trust the html, even if the server is who it says it is.

Re: OpenPGPjs has passed an independent security audit

#76

Post by krn »

nabla9 wrote: post #36
krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

There is nothing wrong with data mining itself. It's completely neutral technology. You are just thrwoing shade with link flooding (those who read the links find out that they don't credibly confirm what you say). Tesonet provides all kinds of services, like hosting, software development and cybersecurity for it's customers.

> There is nothing wrong with data mining itself. It's completely neutral technology.

Tesonet's Oxylabs offers "10+ Million Mobile IPs in Every Country and Every City in the World"[1], which might explain why ProtonVPN, whose Android app is signed by Tesonet[2], is a free service. This is how Luminati, Tesonet's largest competitor in Residential Proxies, operates: it provides a free VPN service, Hola VPN, and then connects its users into a botnet[3], which is used for data mining operations.

[1] https://oxylabs.io/proxies/residential-proxies

[2] http://apkforandroid.org/com.protonvpn.android/34007825-prot...

[3] http://fortune.com/2015/05/29/hola-luminati-vpn/

Re: OpenPGPjs has passed an independent security audit

#77

Post by SahAssar »

Something1234 wrote: post #75
SahAssar wrote: post #68

Earlier quoted context omitted.

Isn't that just SRI in a bookmarklet? With SRI you give the browser a hash and if the resource does not match it does not load.

Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server side, meaning you can't trust the html, even if the server is who it says it is.

Right, but what I'm saying is that you don't need the loader. Just have a bookmarklet with html that contains script tags with SRI. The loader is just another step you need to trust.

Re: OpenPGPjs has passed an independent security audit

#78

Post by SahAssar »

eganist wrote: post #74
SahAssar wrote: post #70

Earlier quoted context omitted.

This was "solved" by a online crypto tool (can't remember which) that basically did HPKP suicide every 30 minutes and had a service worker that loaded cached assets on failure. So the browser would pin to a key that was deleted within minutes and then all subsequent requests would only go through the service worker until the pin expired.

cyph.com

Thanks!

Re: OpenPGPjs has passed an independent security audit

#79

Post by yacn »

rasengan wrote: post #55
crankylinuxuser wrote: post #53

Earlier quoted context omitted.

1. You are the user in question that is a co-founder for PIA. 2. You are a direct competitor to Proton* 3. "Messengers", especially in the position of founder of the competitor, have significant bias. 4. You have a fiduciary reason for them to fail. 5. user protonmail has noted significant harassment regarding this issue Im inclined to distrust both of you. I find that your arguments might have merit. But I also see…

Nothing you said here addressed the facts that were provided. Good luck!

Well one things certain: I'll never use Private Internet Access after this ridiculous comment from you[0] not even three months ago.

[0] https://news.ycombinator.com/item?id=17261149 -- need to have "showdead" enabled in profile

Re: OpenPGPjs has passed an independent security audit

#80

Post by yacn »

EGreg wrote: post #35

Thanks to the great folks at PARAGONIE our open source platform (ie you can actually tell the code is always the same and you can host it yourself) also just passed an independent security audit: https://paragonie.com/audit/L7TtZbFoJBxR91Xg I didn’t think it was worth it to post to HN as news, though. Perhaps I should start posting our achievements a bit more. Like for example our Group Rides feature: https://youtu.b…

> Perhaps I should start posting our achievements a bit more.

Maybe, but don't do it in someone else's thread trying to steal the spotlight from them... Really bad taste.

Post reply on HN