Re: [FD] keybase.io

[Tony Arcieri <bascule@xxxxxxxxx>]

On Monday, June 23, 2014, Jonathan Care <jonc@xxxxxxxxxx> wrote:
>
> Projects like keybase.io, mailvelope, and so on
>

You namedrop these projects as if they're the same thing, but they're not.

- Keybase.io is a web page, and last I looked, they weren't using CSP,
which would help prevent XSS
- Mailvelope (which I use, and like) is a browser plugin. So is Google
End-to-End

Web pages and browser plugins have different threat models. A web page is
ephemeral and fleeting. Attackers can selectively inject attack payloads at
different page load times.

Browser plugins are versioned artifacts. They're installed and updated as
granular, auditable units. Using browser plugins for crypto is much less
objectionable than "just a web page" IMO.

I've written a blog post about this, FWIW:
http://tonyarcieri.com/whats-wrong-with-webcrypto


-- 
Tony Arcieri

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/