Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Contact form encrypts message with PGP before sending

johannes-mittendorfer.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Contact form encrypts message with PGP before sending

#31

Post by y0ghur7_xxx »

devx wrote: post #18
y0ghur7_xxx wrote: post #15

The page loads jquery from google cdn, so at least google could inject js in the page and read the message before it gets encrypted. I know, for a contact form this is very unlikely, but just from a security point of view, if I would write something like this, I would host js loaded by the page on my own server.

I've been wondering about web crypto, and how you can actually be protected from say Google getting your content before it's actually encrypted in the browser. Could Chrome's recent "packaged apps" help with that? Maybe if that part of the web app/extension was actually native/offline (but still inside the browser), it would be secure against that. Of course then you have to start wondering whether Google didn't impl…

I've been wondering about web crypto, and how you can actually be protected from say Google getting your content before it's actually encrypted in the browser.

Just don't load third party js from a domain you don't own, use tls and you are good.

Re: Contact form encrypts message with PGP before sending

#32

Post by willvarfar »

manojlds wrote: post #29
willvarfar wrote: post #16

Earlier quoted context omitted.

Presuming the private key for the messages is not on the server, then old messages will not be compromised. A kind of perfect secrecy for messages.

Forward secrecy with https? https://community.qualys.com/blogs/securitylabs/2013/08/05/c...

yeah its often called perfect forward secrecy - PFS - too.

http://en.wikipedia.org/wiki/Perfect_forward_secrecy

Re: Contact form encrypts message with PGP before sending

#33

Post by schrodinger »

joushx wrote: post #26
st00pid wrote: post #24

google cannot translate his form. Why not? If I can see it, so can google.

Looks like gtranslate doesn't support https. Strange.

It's intentional so they don't try and translate, say, your bank statement and end up sending it to google servers.

Re: Contact form encrypts message with PGP before sending

#34

Post by willholloway »

eli wrote: post #30

This idea (encryption in javascript in a regular web browser) comes up very often on HN. It's not a good idea. Since I have no way to trust/verify that the encryption code itself has not been tampered with (beyond HTTPS) then it is only secure as HTTPS. You've added a fair bit of complexity for no specific benefit; likely a net loss in terms of security.

What about:

1) Comparing hash of the js files loaded externally.

or

2) Keeping hash authenitcated javascript files from local disk?

Re: Contact form encrypts message with PGP before sending

#35

Post by true_religion »

schrodinger wrote: post #33
joushx wrote: post #26

Earlier quoted context omitted.

Looks like gtranslate doesn't support https. Strange.

It's intentional so they don't try and translate, say, your bank statement and end up sending it to google servers.

I'm on Chrome and it handily translated the form.

Re: Contact form encrypts message with PGP before sending

#37

Post by eli »

willholloway wrote: post #34
eli wrote: post #30

This idea (encryption in javascript in a regular web browser) comes up very often on HN. It's not a good idea. Since I have no way to trust/verify that the encryption code itself has not been tampered with (beyond HTTPS) then it is only secure as HTTPS. You've added a fair bit of complexity for no specific benefit; likely a net loss in terms of security.

What about: 1) Comparing hash of the js files loaded externally. or 2) Keeping hash authenitcated javascript files from local disk?

1) Compare the hash to what exactly?

2) Then why not just store the files themselves to local disk? They can't be updated anyway. Or, indeed, just install GPG.

Post reply on HN