Nice, but how did you port openpgp to Javascript?
I guess he used this lib: https://github.com/openpgpjs/openpgpjs/
Yes, that's true.
Contact form encrypts message with PGP before sending
21–30 of 37 posts
Re: Contact form encrypts message with PGP before sending
#22The page loads jquery from google cdn, so at least google could inject js in the page and read the message before it gets encrypted. I know, for a contact form this is very unlikely, but just from a security point of view, if I would write something like this, I would host js loaded by the page on my own server.
Yeah, that's a point. Maybe i should really do that...
Re: Contact form encrypts message with PGP before sending
#23I love the usability of this.
I hope the issue of usability gets more attention in future security tool development.
Re: Contact form encrypts message with PGP before sending
#24 google cannot translate his form.
Why not? If I can see it, so can google.
Re: Contact form encrypts message with PGP before sending
#25 google cannot translate his form.
Why not? If I can see it, so can google.
Re: Contact form encrypts message with PGP before sending
#26google cannot translate his form. Why not? If I can see it, so can google.
Looks like gtranslate doesn't support https. Strange.
Re: Contact form encrypts message with PGP before sending
#27Is there any benefit of doing this on the client side? The message is sent through HTTPS anyway. If HTTPS was compromised, the javascript code signing the message, and the signing key, and everything related to handling the clear text message would be compromised too anyway. This is redundant with HTTPS, but also useless if HTTPS is MITM.
Eh, it might be a bit useful if there's a passive adversary on the server. They can read traffic, but not change anything. Pretty unlikely scenario, so it doesn't really buy you much.
Your cloud hosting provider can easily be a passive adversary. Altering your data is risky for them (you might notice) so they won't alter your copy of openpgp.js or the public keys you use. But looking at all of your disk and memory and network is something they can do and you would never know. But if the private key is not on the server, they will never be able to decrypt the messages encrypted for you....
Re: Contact form encrypts message with PGP before sending
#28Earlier quoted context omitted.
Presuming the private key for the messages is not on the server, then old messages will not be compromised. A kind of perfect secrecy for messages.
No need to do this on the client side then (that was my point)
You could do the exact same thing on the server, but that's using server's CPU instead of clients?
Re: Contact form encrypts message with PGP before sending
#29Earlier quoted context omitted.
If your browser is untrusted, you are doomed. > Furthermore, this helps against content disclosure if the server is compromised. If the server is compromised, openpgp.js is compromised too.
Presuming the private key for the messages is not on the server, then old messages will not be compromised. A kind of perfect secrecy for messages.
Forward secrecy with https? https://community.qualys.com/blogs/securitylabs/2013/08/05/c...
Re: Contact form encrypts message with PGP before sending
#30This idea (encryption in javascript in a regular web browser) comes up very often on HN. It's not a good idea. Since I have no way to trust/verify that the encryption code itself has not been tampered with (beyond HTTPS) then it is only secure as HTTPS.
You've added a fair bit of complexity for no specific benefit; likely a net loss in terms of security.