Contact form encrypts message with PGP before sending
johannes-mittendorfer.com
Contact form encrypts message with PGP before sending
1–10 of 37 posts
Re: Contact form encrypts message with PGP before sending
#2Nice, but how did you port openpgp to Javascript?
Re: Contact form encrypts message with PGP before sending
#3Nice, but how did you port openpgp to Javascript?
I guess he used this lib: https://github.com/openpgpjs/openpgpjs/
Re: Contact form encrypts message with PGP before sending
#4It must be suck to be Johannes right now... I wonder how many emails containing random gibberish he is receiving?
Re: Contact form encrypts message with PGP before sending
#5And where's the key stored on the client and how is it shared with the server?
I'm too lazy to parse their JS code.
Re: Contact form encrypts message with PGP before sending
#6And where's the key stored on the client and how is it shared with the server? I'm too lazy to parse their JS code.
You don't need a private client key for just encryption, the public key of the recipient is sufficient.
For signing, you'd need a pub/priv keypair, but this is not implemented here.
Re: Contact form encrypts message with PGP before sending
#7[deleted]
Re: Contact form encrypts message with PGP before sending
#8And where's the key stored on the client and how is it shared with the server? I'm too lazy to parse their JS code.
$.get("/static/pgpkey", function (key) {
// store key
// hook to submit button click event & encrypt before submit
});
Re: Contact form encrypts message with PGP before sending
#9Is there any benefit of doing this on the client side?
The message is sent through HTTPS anyway.
If HTTPS was compromised, the javascript code signing the message, and the signing key, and everything related to handling the clear text message would be compromised too anyway.
This is redundant with HTTPS, but also useless if HTTPS is MITM.
Re: Contact form encrypts message with PGP before sending
#10I'm not sure what this adds over applying PGP on the server?
The way to intercept the message with the server doing PGP would be to either MITM the connection or breach into the server to intercept before encryption.
In both cases you could just as well modify the javascript served to the browser to defeat the PGP done in the browser as well.