Scramble.io: secure email for everyone
11–20 of 142 posts
Re: Scramble.io: secure email for everyone
#12Whenever I see a site with the fixed background images and scrolling content panels (where the background image is periodically visible again), I spend more time trying to figure out what's contained in the background images through those gaps than I do reading the content.
Re: Scramble.io: secure email for everyone
#13Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
Wouldn't that require the user to install the browser extension to use the service? That would lock out a lot of people that would find this service useful (eg. Tails users).
Re: Scramble.io: secure email for everyone
#14Now the question is -- why doesn't Google do this with Gmail?
Re: Scramble.io: secure email for everyone
#15I'm glad to see more projects taking off with the goal of secure email.
I found it really annoying that this service has xkcd style password requirements. My 9-character password with non-alphanumeric characters should be sufficient.
Re: Scramble.io: secure email for everyone
#16Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
You can have a signing committee vet the asset files and publish the signatures, which the browser extension looks for. It allows an upgrade path without having to go through the browser app store. For example, browser extensions installed using the Chrome app store updates automatically, which implies trust in Google.
The browser extension would only load vetted assets onto the DOM. In other words, you visit the site by opening a new tab and clicking on the extension. It then loads assets and checks that all the assets are signed by a trusted list of code-vetting signers. If all the signatures look good, then it loads the assets onto the DOM. This is no less secure than having all the client code in the extension.
Re: Scramble.io: secure email for everyone
#17Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
You can have a signing committee vet the asset files and publish the signatures, which the browser extension looks for. It allows an upgrade path without having to go through the browser app store. For example, browser extensions installed using the Chrome app store updates automatically, which implies trust in Google. The browser extension would only load vetted assets onto the DOM. In other words, you visit the sit…
You can't just verify the static asset files, because that's not all the browser looks at when it builds up the Javascript runtime state.
Re: Scramble.io: secure email for everyone
#18Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
Wouldn't that require the user to install the browser extension to use the service? That would lock out a lot of people that would find this service useful (eg. Tails users).
SO WHAT? This is absolutely the most aggravating thing about JS crypto advocates: they truly believe that bad engineering can be turned into good engineering by sheer wishfulness. It's important, they say, for people who can't install new software to have encrypted messaging; therefore, browser javascript cryptography has to work. No.
Re: Scramble.io: secure email for everyone
#19Cool, this was the architecture I sketched in my head for a user-friendly PGP app, although I would have offered to sync the private keys between device clients, rather than doing it all in browser (that way, someone can opt out and keep a key just on their phone or whatever.)
I had a damn good name, too, but good job someone else did it so I don't have to! :)
Re: Scramble.io: secure email for everyone
#20Earlier quoted context omitted.
You can have a signing committee vet the asset files and publish the signatures, which the browser extension looks for. It allows an upgrade path without having to go through the browser app store. For example, browser extensions installed using the Chrome app store updates automatically, which implies trust in Google. The browser extension would only load vetted assets onto the DOM. In other words, you visit the sit…
You can't just verify the static asset files, because that's not all the browser looks at when it builds up the Javascript runtime state.
What else does it look at?
I don't see what else would affect it besides things that you could also verify in theory.