Re:FileKit: An open source end-to-end encrypted cloud storag...
by tptacek on Thursday August 29, 2019 @08:45PM
(#20835042)
I don't love browser extensions but the trust model issues with it are not identical to content-controlled Javascript.
Re:FileKit: An open source end-to-end encrypted cloud storag...
by tipiak on Friday August 30, 2019 @04:21AM
(#20836740)
The issue with browser extensions, is that you are not far away from the common hurdles of developing, using and releasing a "real" desktop/mobile application. Having nothing to install and landing on a page that just works, is a big plus for you users.
What do you think of doing JavaScript Crypto in a browser extension? An extension runs code in the browser without persistent trust of a server (at least in the traditional webapp way; you have to persistently trust the extension update server, extension authors, chrome update server, etc). You could do things like quickly, interactively encrypt chunks of text with a symmetric key. Presumably you'd use an extension UI to enter your keys, to avoid keylogging.
I think it would be illuminating to have a small suite of well-implemented cryptographic primitives, curated by a well-known expert, installed and ready to use on any string in the browser.
(BTW why don't we see more random chunks of cyphertext everywhere? It would seem to me a good channel, to use a combination of public forums to transfer short bursts of cyphertext. Where are the encrypted Twitter broadcasts??)