Re:Lavabit code open sourced
by pfg on Saturday April 30, 2016 @08:24PM
(#11604304)
I'd argue it's not significantly better than any existing product that uses transport-level security without E2E crypto. Both systems are likely to be broken if there's a server-side breach, though I'd admit there's a bit more effort involved for an attacker (planting a backdoor and collecting keys as opposed to just dumping the whole data set).
[ Parent
| on HN ]
Re:Lavabit code open sourced
by chrisfosterelli on Saturday April 30, 2016 @08:29PM
(#11604320)
Definitely. I think that's why companies that do this (like SpiderOak and Keybase) implement client-side web crypto for convenience use but provide a pretty visible warning about the potential pitfalls compared to the desktop app, so users can make an informed choice.
A lot of people are researching solutions like the app-cache approach to try and fix this, fortunately it's getting better!