how do I create/add the public key of a contact?
We plan to add functionality soon! As well as exporting your public/private key.
Scramble.io: secure email for everyone
21–30 of 142 posts
Re: Scramble.io: secure email for everyone
#22Earlier quoted context omitted.
You can't just verify the static asset files, because that's not all the browser looks at when it builds up the Javascript runtime state.
What else does it look at? I don't see what else would affect it besides things that you could also verify in theory.
Why don't you start building out the answer to that question yourself?
Re: Scramble.io: secure email for everyone
#23Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
I'm not a programmer. Why can't you just digest or hash the JS?
Just curious : what does a non-programmer come to HN for? Everything seems fairly programming centric to me here...
Re: Scramble.io: secure email for everyone
#24Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
I'm not a programmer. Why can't you just digest or hash the JS?
Because when the JS files are updated the browser extension will have to fetch a new hash from the server, but how can that hash be trusted? The usual mechanism would be to RSA or DSA sign the JS files and have the extension validate the signature against a public key. However, we're still choosing to trust the server and hope that it's key is not compromised.
Re: Scramble.io: secure email for everyone
#25Now the question is -- why doesn't Google do this with Gmail?
Their whole business model revolves around data mining. You can't really mine encrypted mail. If you can then the encryption is worthless.
Re: Scramble.io: secure email for everyone
#26Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
I'm not a programmer. Why can't you just digest or hash the JS?
Think about it this way: if you already had a guaranteed-secure method for delivering a hash... then you don't need a hash, you could just use this magical secure delivery mechanism to deliver all the code directly -- or even your whole email message!
Re: Scramble.io: secure email for everyone
#27Earlier quoted context omitted.
I'm not a programmer. Why can't you just digest or hash the JS?
Because when the JS files are updated the browser extension will have to fetch a new hash from the server, but how can that hash be trusted? The usual mechanism would be to RSA or DSA sign the JS files and have the extension validate the signature against a public key. However, we're still choosing to trust the server and hope that it's key is not compromised.
That's actually not the big reason.
Re: Scramble.io: secure email for everyone
#28Another week, another Javascript cryptography project. See: https://news.ycombinator.com/item?id=6637915 https://news.ycombinator.com/item?id=6420739 https://news.ycombinator.com/item?id=6353137 https://news.ycombinator.com/item?id=6317685 (That's just the last few weeks). We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of…
Wouldn't that require the user to install the browser extension to use the service? That would lock out a lot of people that would find this service useful (eg. Tails users).
They would find the illusion of security useful?
Re: Scramble.io: secure email for everyone
#29Whenever I see a site with the fixed background images and scrolling content panels (where the background image is periodically visible again), I spend more time trying to figure out what's contained in the background images through those gaps than I do reading the content.
It's a bright night sky: http://dcposch.github.io/scramble/img/night_sky_bright.jpg
Re: Scramble.io: secure email for everyone
#30Earlier quoted context omitted.
You can't just verify the static asset files, because that's not all the browser looks at when it builds up the Javascript runtime state.
What else does it look at? I don't see what else would affect it besides things that you could also verify in theory.
A hostile browser extension which has permission to access all pages could inject its own code at runtime.