OpenPGPjs has passed an independent security audit
protonmail.com
OpenPGPjs has passed an independent security audit
1–10 of 128 posts
Re: OpenPGPjs has passed an independent security audit
#2Have any current protonmail users experienced denial of service from online providers solely because of their email address?
Re: OpenPGPjs has passed an independent security audit
#3Have any current protonmail users experienced denial of service from online providers solely because of their email address?
Not yet at around a year worth of usage. I use a custom .space address which I thought would bring its own issues, but hasn't. I have spf, dkim, and dmarc setup with it as well.
Re: OpenPGPjs has passed an independent security audit
#4Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened.
And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
Re: OpenPGPjs has passed an independent security audit
#5Have any current protonmail users experienced denial of service from online providers solely because of their email address?
Yupp. My account at a particular website was terminated. They pointed to their TOS, where "anonymous" address are not allowed. Wasn't even given the chance to keep the account and change the email to an "acceptable" one.
Re: OpenPGPjs has passed an independent security audit
#6Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
isn't this why https://developer.mozilla.org/en-US/docs/Web/Security/Subres... was invented?
Re: OpenPGPjs has passed an independent security audit
#7> The only limitations come from the platform itself (JavaScript/web), which do not allow for side channel resistance or reliable constant time operations. Overall however this is an exceptional library for JavaScript cryptography.
How would this compare to something like WebCrypto, which assume would be implemented in a way that would allow for side channel resistance etc? It does seem surprising that we don't have something like a browser API version of libsodium in widespread use already.
Re: OpenPGPjs has passed an independent security audit
#8Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
Remember when Hushmail backdoored their client-side applet to capture unencrypted emails and passwords?
Re: OpenPGPjs has passed an independent security audit
#9I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1].
[1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)
Re: OpenPGPjs has passed an independent security audit
#10Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.
isn't this why https://developer.mozilla.org/en-US/docs/Web/Security/Subres... was invented?
If you can change out the JS payload, you can probably also swap out the HTML which supposedly "secures" it.
If the users had the option of "locking" a JS version with the Subresource Integrity attribute that they are currently using, it might help.