Scramble.io: secure email for everyone

Post by tptacek » Tue, Nov 05, 2013, 7:28 PM UTC

kingzero wrote: post #105

dcposch wrote: post #52

Earlier quoted context omitted.

PS: Most users are not power users, and won't download the extension and manually check signatures. As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated. As long as you have a critical mass of power users who installed the extension, an adversary…

> As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated. Imagine the following. An Attacker manages to hijack your server. They fingerprint[1] the browsers of each user and only send malicious JS to certain users that dont use your extension. No on…

Post by kingzero » Tue, Nov 05, 2013, 7:36 PM UTC

dcposch wrote: post #85

brown9-2 wrote: post #78

Users don't have to manage and back up their keys---or even know what a key is. Scramble does it for you. As a user, why would I want to delegate my key management to you? Encrypting the email I want to send to a person with their public key is what gives me a sense of trust that what I am sending is encrypted and only readable to that person. However--as the example of Tormail and others show us--the server cannot b…

> As a user, why would I want to delegate my key management to you? The beauty of it is that Scramble encrypts and signs whenever the recipient is also a Scramble address--automatically. The goal is to protect even users who don't know what a "PGP key" is. (Don't get me wrong, we're planning improvements for power users as well--for example, we want to make it easy to use Scramble over Tor. But the goal really is "En…

Post by blahbl4hblahtoo » Tue, Nov 05, 2013, 7:56 PM UTC

jaekwon wrote: post #110

mdip wrote: post #67

Earlier quoted context omitted.

Its [sic] funny that people have to all learn the same lessons over and over again That pretty much defines what the field of computer security is . From DES to AES, we learned the same lesson: As things designed to be secure are put out in the real world, with sufficient enough time, they're broken. It's important not to make the same mistakes again and again, and that's nearly impossible to do with JS-Crypto since…

That's already happened w/ the crypto.getRandomNumber function, which openpgp.js uses/

Post by jmccree » Tue, Nov 05, 2013, 8:18 PM UTC

hershel wrote: post #91

tptacek wrote: post #86

Earlier quoted context omitted.

Let's stipulate that your detection system, which does not currently exist even as a design document, actually works. By your own admission, only a small minority of users will actually install it. Now: a whistleblower in the USG, who is much more likely not to be a "power user" (if they were clueful they wouldn't be using this system to begin with) leaks a document from your service to a journalist and begins a conv…

Tptacek, whistle blowers level security should not be a use case for this extension , and should be advertised as part of it. But decreasing the amount of dragnet surveillance by some extent sounds like a good thing to me. For example, many people wouldn't like the government to know mundane stuff about them, like having an abortion.This could help. * BTW haven't moxie written about an asynchronous diffie hellman key…

Post by orthecreedence » Tue, Nov 05, 2013, 8:28 PM UTC

marcinw wrote: post #118

orthecreedence wrote: post #100

Earlier quoted context omitted.

Perhaps I'm ignorant, but I've read your "JS crypto considered harmful post" and I disagree with the key points. 1. Browsers, at least the ones that matter, provide window.crypto (with a CSPRNG). This makes generating IV's for CBC "safe," makes generating RSA keys "safe," makes generating random keys "safe." Or am I missing something? Assuming the JS crypto code itself is actually sound, the PRNG seems to be the miss…

Java, Python, etc don't have a DOM to consider. When you're just an XSS away from an attacker doing: function encrypt(plaintext) { $.post(plaintext, ...); return plaintext; } then you lose. The post talks about this, and XSS isn't the only way either.