OpenPGPjs has passed an independent security audit

Re:OpenPGPjs has passed an independent security audit by cortesoft on Thursday August 16, 2018 @12:25PM (#17776034)

You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by peterwwillis on Thursday August 16, 2018 @12:29PM (#17776074)

They're using key pinning, so you would have to use one of Google's keys and use one of Google's authorized CAs. But second, I imagine the auto-update process is using a non-TLS certificate to verify the signed binaries. Either way you have to hack Google.

It would actually be much easier to just find a vuln in Chrome that can break out of sandbox and get root.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by h1d on Friday August 17, 2018 @12:27AM (#17780286)

Or hack the team who signs.

[ Parent | on HN ]

Re:OpenPGPjs has passed an independent security audit by kawsper on Thursday August 16, 2018 @12:44PM (#17776279)

So Chrome doesn't use certificate pinning for distributing updates?

[ Parent | on HN ]