full-disclosure

Open Source and information security mailing list archives

Message-ID: <CAHOTMVLamvXmNdTZYK3s4aT2YmHkPDKjo78LvTnHU=tQkr1kXQ@mail.gmail.com>
Date: Mon, 23 Jun 2014 12:52:10 -0700
From: Tony Arcieri <bascule@...il.com>
To: Jonathan Care <jonc@...dis.org>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] keybase.io

On Monday, June 23, 2014, Jonathan Care <jonc@...dis.org> wrote:
>
> Projects like keybase.io, mailvelope, and so on
>

You namedrop these projects as if they're the same thing, but they're not.

- Keybase.io is a web page, and last I looked, they weren't using CSP,
which would help prevent XSS
- Mailvelope (which I use, and like) is a browser plugin. So is Google
End-to-End

Web pages and browser plugins have different threat models. A web page is
ephemeral and fleeting. Attackers can selectively inject attack payloads at
different page load times.

Browser plugins are versioned artifacts. They're installed and updated as
granular, auditable units. Using browser plugins for crypto is much less
objectionable than "just a web page" IMO.

I've written a blog post about this, FWIW:
http://tonyarcieri.com/whats-wrong-with-webcrypto

-- 
Tony Arcieri

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives