OpenPGPjs has passed an independent security audit

Re:OpenPGPjs has passed an independent security audit by peterwwillis on Thursday August 16, 2018 @12:15PM (#17775928)

Attack vectors for replacing Chrome:

  - Hack Google

Attack vectors for replacing OpenPGPjs:

  - Hack the servers hosting OpenPGPjs
  - Hack the browser to inject or replace content across domains, sandboxes, other security barriers

It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications.

Another way to think of it is if your entire Linux OS were actually just web apps with GUIs. Every time you run 'bash', it was actually downloaded from a remote server. And every time you used bash, and it used some plug-in which was hosted on some other site, that plug-in could be compromised, and could be trying to attack your OS, which if successful, would compromise your entire host.

That doesn't happen right now because all the apps sit on your host, aren't constantly re-acquired, aren't constantly subject to potential 3rd party attacks over a wide surface area. Though this does sort-of happen with programming language package managers like npm, pip and so on. But you can pin those versions and hashes if you're paranoid, which I don't think you can do with a browser.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by cortesoft on Thursday August 16, 2018 @12:25PM (#17776034)

You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by peterwwillis on Thursday August 16, 2018 @12:29PM (#17776074)

They're using key pinning, so you would have to use one of Google's keys and use one of Google's authorized CAs. But second, I imagine the auto-update process is using a non-TLS certificate to verify the signed binaries. Either way you have to hack Google.

It would actually be much easier to just find a vuln in Chrome that can break out of sandbox and get root.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by h1d on Friday August 17, 2018 @12:27AM (#17780286)

Or hack the team who signs.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by kawsper on Thursday August 16, 2018 @12:44PM (#17776279)

So Chrome doesn't use certificate pinning for distributing updates?

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by bigiain on Thursday August 16, 2018 @07:52PM (#17779365)

> Attack vectors for replacing Chrome:

> - Hack Google

  - NSL Google

(If you're a high-enough value target and your adversary is the US Government. But in _that_ case you've probably already lost - you might just not know it yet. I wonder if Snowden uses Chrome or lets it autoupdate?)

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by FrozenTuna on Friday August 17, 2018 @10:33AM (#17783066)

That's a good question. I don't think the government cares enough about snowden to do that. Snowden's damage has been done. It can't be reversed. Imo, they'd be much more interested to preemptively shutdown all future would-be Snowdens.

[ Parent | on HN ]