Contact form encrypts message with PGP before sending

Re:Contact form encrypts message with PGP before sending by mfwoods on Sunday September 15, 2013 @09:10AM (#6388968)

I'm not sure what this adds over applying PGP on the server?

The way to intercept the message with the server doing PGP would be to either MITM the connection or breach into the server to intercept before encryption.

In both cases you could just as well modify the javascript served to the browser to defeat the PGP done in the browser as well.

[ Parent | on HN ]

Re:Contact form encrypts message with PGP before sending by zobzu on Sunday September 15, 2013 @09:31AM (#6389018)

it adds not much. it does make it more complex to intercept because you need to serve diff js. il also means cleartext isnt on the server at all til compromised.

but yeah the design is bypassable. thus not really safe. clients should do it natively i guess.

[ Parent | on HN ]