Skiff – Privacy-first end-to-end encrypted email

Re:Skiff – Privacy-first end-to-end encrypted email by tptacek on Wednesday August 23, 2023 @12:22AM (#37231849)

What difference does this make to the thread model in the previous comment?

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by amilich on Wednesday August 23, 2023 @12:43PM (#37238716)

Before this basic cryptography was downloaded via JS files which yields no security and gave web cryptography a bad reputation. That is not true now.

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by onereplyac2 on Wednesday August 23, 2023 @12:57PM (#37238907)

Huh? It is very concerning to hear this from a founder. It is the same exact level of security as it is executing the same code, just at a different level. Really does not matter what crypto lib you are using if at the end of the day the surrounding code dictates all the security.

Regardless of all this, your open source crypto library doesn't even use the Web Crypto APIs at all, but rather the dreaded js based crypto you are badmouthing (tweetnacl, stablelib)

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by amilich on Wednesday August 23, 2023 @07:19PM (#37243202)

That's just false. Downloading crypto libraries over the web plagued Javascript crypto for years. We use tweetnacl, stablelib, and webcrypto - and tweetnacl also uses webcrypto!

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by onereplyac2 on Wednesday August 23, 2023 @08:41PM (#37243774)

From your source, chacha20 is used, which is literally not supported by web crypto apis. Again, this makes 0 difference as higher level implementation makes or breaks your crypto.

[ Parent | on HN ]

Re:Skiff – Privacy-first end-to-end encrypted email by bastawhiz on Wednesday August 23, 2023 @02:48PM (#37240460)

There's literally nothing stopping the page from simply not encrypting the data.

[ Parent | on HN ]