lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Jun 2014 12:52:10 -0700
From: Tony Arcieri <bascule@...il.com>
To: Jonathan Care <jonc@...dis.org>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] keybase.io

On Monday, June 23, 2014, Jonathan Care <jonc@...dis.org> wrote:
>
> Projects like keybase.io, mailvelope, and so on
>

You namedrop these projects as if they're the same thing, but they're not.

- Keybase.io is a web page, and last I looked, they weren't using CSP,
which would help prevent XSS
- Mailvelope (which I use, and like) is a browser plugin. So is Google
End-to-End

Web pages and browser plugins have different threat models. A web page is
ephemeral and fleeting. Attackers can selectively inject attack payloads at
different page load times.

Browser plugins are versioned artifacts. They're installed and updated as
granular, auditable units. Using browser plugins for crypto is much less
objectionable than "just a web page" IMO.

I've written a blog post about this, FWIW:
http://tonyarcieri.com/whats-wrong-with-webcrypto


-- 
Tony Arcieri

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists