Scramble.io: secure email for everyone

Re:Scramble.io: secure email for everyone by jahewson on Tuesday November 05, 2013 @12:31PM (#6676424)

Or just have the signing committee publish signed JS code. There's no real difference between that and publishing a signed hash. Unfortunately other hostile extensions are still free to mess with the DOM, so it's all a bit pointless.

[ Parent | on HN ]

Re:Scramble.io: secure email for everyone by jaekwon on Tuesday November 05, 2013 @01:21PM (#6676902)

A secure environment would require a vetted browser and no other hostile extensions. That's certainly possible, so Scramble does have a use.

[ Parent | on HN ]

Re:Scramble.io: secure email for everyone by tptacek on Tuesday November 05, 2013 @01:54PM (#6677198)

I see. So, if I set up an intricate browser clean-room environment, and I assume that the Javascript verification system you come up with actually works, I can get some of the benefit of simply installing GPG and using POP mail.

[ Parent | on HN ]

Re:Scramble.io: secure email for everyone by jaekwon on Tuesday November 05, 2013 @02:15PM (#6677373)

You'd still have to vet your GPG install & mail client code. Also, it's not difficult to fork the code to create a client that doesn't use the browser at all. It just hasn't happened yet.

How do you know which public key belongs to the address? Key servers? Web-of-trust? Look it up on their homepage?

Scramble has an address -> pubkey resolution system which balances security with usability.

At least with Scramble you can create a secure USB stick to boot from with all of that preconfigured. Any solution that uses bare GPG still has severe usability problems.

http://www.gaudior.net/alma/johnny.pdf

[ Parent | on HN ]

Re:Scramble.io: secure email for everyone by tptacek on Tuesday November 05, 2013 @02:54PM (#6677725)

"Balances security with usability" is here literally a euphemism for "trades security for usability".

[ Parent | on HN ]

Re:Scramble.io: secure email for everyone by blahbl4hblahtoo on Tuesday November 05, 2013 @02:28PM (#6677494)

Verifying the code on your system is something that can be easily done and easily verified the next time you use it. Its your system after all.

I salute what you are trying to do, but you have to understand that the Js browser method, as it stands today, is a dead end.

[ Parent | on HN ]