Scramble.io: secure email for everyone

#1

Post by dcposch » Tue, Nov 05, 2013, 4:34 PM UTC

Scramble.io: secure email for everyone
dcposch.github.io

Re: Scramble.io: secure email for everyone

#2

Post by davedx » Tue, Nov 05, 2013, 4:48 PM UTC

Fantastic. Tighten up the user interface and this should gain traction. Checking out the Github repo now.

Re: Scramble.io: secure email for everyone

#3

Post by woah » Tue, Nov 05, 2013, 4:49 PM UTC

davedx wrote: post #2

Fantastic. Tighten up the user interface and this should gain traction. Checking out the Github repo now.

Working on it! New interface should be out in the next few weeks. Check out the "frontend-makeover" branch if you are interested.

Re: Scramble.io: secure email for everyone

#4

Post by davedx » Tue, Nov 05, 2013, 4:50 PM UTC

woah wrote: post #3

davedx wrote: post #2

Fantastic. Tighten up the user interface and this should gain traction. Checking out the Github repo now.

Working on it! New interface should be out in the next few weeks. Check out the "frontend-makeover" branch if you are interested.

Sounds great. I'd love to contribute to something like this.

Re: Scramble.io: secure email for everyone

#5

Post by special » Tue, Nov 05, 2013, 4:52 PM UTC

It prompts you if you try to send an email to someone without using their public key. I dig it.

Edit: Also links you to xkcd if you pick a crappy password: http://i.imgur.com/TJ3QPP7.png

Re: Scramble.io: secure email for everyone

#6

Post by frank_boyd » Tue, Nov 05, 2013, 4:58 PM UTC

Encryption done in the browser?

Why would you take that risk and not encrypt in a client using GPG?

Re: Scramble.io: secure email for everyone

#7

Post by tptacek » Tue, Nov 05, 2013, 4:59 PM UTC

Another week, another Javascript cryptography project. See:

https://news.ycombinator.com/item?id=6637915

https://news.ycombinator.com/item?id=6420739

https://news.ycombinator.com/item?id=6353137

https://news.ycombinator.com/item?id=6317685

(That's just the last few weeks).

We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of a server could tamper with the JS to steal a user's credentials the next time they log in.)

Baffling. If you're going to build a browser extension, put the crypto code in the extension. This still isn't a great solution, but it's better than trying to "verify the Javascript code". How exactly do you plan to do that? Surely you realize you can't just digest the JS asset files.

Re: Scramble.io: secure email for everyone

#8

Post by lazyant » Tue, Nov 05, 2013, 4:59 PM UTC

how do I create/add the public key of a contact?

Re: Scramble.io: secure email for everyone

#9

Post by DigitalJack » Tue, Nov 05, 2013, 5:01 PM UTC

tptacek wrote: post #7

Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…

I'm not a programmer. Why can't you just digest or hash the JS?

Re: Scramble.io: secure email for everyone

#10

Post by JulianMorrison » Tue, Nov 05, 2013, 5:03 PM UTC

Unvetted cryptography is worth 1 cereal packet sekrit decoder ring.