Show HN: Get encrypted data from people that don’t know how to encrypt
1–10 of 96 posts
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#2This is excellent and very helpful for my volunteer work.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#3This is really smart, especially with something like protonmail.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#4Looks great, this is something that is missing from Keybase (specifically, the email sending part).
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#5js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#6js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
Yes, you really need to host your own server and audit the code carefully.
Which moves the threat to state actors willing to substitute certs, and that's the point at which the web fails you totally anyway.
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#7js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#8 $ echo "Hello world" > message.txt
gpg --sign message.txt
$ gpg --verify message.txt.gpg
gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
gpg: Good signature from "John Smith "
$ echo "evil" > message.txt
$ gpg --verify message.txt.gpg
gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
gpg: Good signature from "John Smith "Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#9How is this different from e2e-encrypted webchat?
Re: Show HN: Get encrypted data from people that don’t know how to encrypt
#10js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.
Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?
What about SRI?
"Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match."
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...