On Monday, June 23, 2014, Jonathan Care <j...@tardis.org> wrote: > > Projects like keybase.io, mailvelope, and so on >
You namedrop these projects as if they're the same thing, but they're not. - Keybase.io is a web page, and last I looked, they weren't using CSP, which would help prevent XSS - Mailvelope (which I use, and like) is a browser plugin. So is Google End-to-End Web pages and browser plugins have different threat models. A web page is ephemeral and fleeting. Attackers can selectively inject attack payloads at different page load times. Browser plugins are versioned artifacts. They're installed and updated as granular, auditable units. Using browser plugins for crypto is much less objectionable than "just a web page" IMO. I've written a blog post about this, FWIW: http://tonyarcieri.com/whats-wrong-with-webcrypto -- Tony Arcieri _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
