11–20 of 71 posts
This is a browser addon, right? Is everything loaded locally? If no, what prevents you from putting up some javascript that transfers the decryption password (or the plain text) to you. Sorry, didn't bother to download and look for the source code, to find out how the inner mechanics work. The website doesn't give much information either.
Earlier quoted context omitted.
Well, selling out American millionaires is one thing, I have a feeling the Swiss would be less willing to sell out private communications to the NSA.
Because...
This appears to be a PHP wrapper around OpenPGP.js. If the encryption comes from Javascript loaded by browsers from the servers every time they visit the site, the encryption isn't "end to end". It's controlled by the server and can be broken by the server. Also: the RSA Security logo isn't the logo of the RSA algorithm; it's the logo of the company that sells RSA tokens.
This appears to be a PHP wrapper around OpenPGP.js. If the encryption comes from Javascript loaded by browsers from the servers every time they visit the site, the encryption isn't "end to end". It's controlled by the server and can be broken by the server. Also: the RSA Security logo isn't the logo of the RSA algorithm; it's the logo of the company that sells RSA tokens.
The JS doesn't appear to be compressed so it's possible to view source and see what exactly it's doing. So if it was actually backdoored, somebody will actually find out.
The site even helpfully asks you to identify yourself with ANOTHER username and passphrase first, making it even safer for the attacker.
This appears to be a PHP wrapper around OpenPGP.js. If the encryption comes from Javascript loaded by browsers from the servers every time they visit the site, the encryption isn't "end to end". It's controlled by the server and can be broken by the server. Also: the RSA Security logo isn't the logo of the RSA algorithm; it's the logo of the company that sells RSA tokens.
The JS doesn't appear to be compressed so it's possible to view source and see what exactly it's doing. So if it was actually backdoored, somebody will actually find out.
And you have to do this every time you load any page on the site, and any time any of those pages asynchronously load any content.
So, no, contrary to popular belief, this doesn't work.
This holds up "No private / public key management." as a feature. Without key management (specifically, secure generation, storage, and authentication) encryption is worse than useless.
Funny, when I hear "Switzerland" I think about how just this morning I heard that the American IRS has finally broken the long standing tradition of Swiss banking privacy, and that CreditSuisse will be paying billions of dollars in fines.
This appears to be a PHP wrapper around OpenPGP.js. If the encryption comes from Javascript loaded by browsers from the servers every time they visit the site, the encryption isn't "end to end". It's controlled by the server and can be broken by the server. Also: the RSA Security logo isn't the logo of the RSA algorithm; it's the logo of the company that sells RSA tokens.
I tire of hearing this repetitively, every time somebody attempts to take this path, but I recognize you are doing it for anybody that is new and didn't hear the other warnings.
Isn't the perfect the enemy of the good?
Can we recognize that this is a good first step, and definitely constitutes a huge improvement over gmail/yahoo type webmail solutions?
You can still quickly add a disclaimer that you hope they quickly begin the large task of development of native windows/mac/linux/ios/android apps that will remove the javascript concern.
If you spit on everything that is not perfect, you may be steering people away from taking any action to protect their privacy.