Re: 2. Yes, you can't have any other browser extensions. But that is totally unrealistic. It's just a a complete showstopper.
Even a bookmarklet could bypass your cryptosystem!
>> A better approach would be to have the client pull a list of revoked certs along with the JS source/hash.
That's not much better, as the client will have to pull a list from somewhere, and that somewhere could have been compromised to serve a bad list. At least with a window you always need an absolute majority. I'm not liking any of these solutions, so you make a good case for packaging an extension with all of the client code!
>> It's enough for me because I don't use any browser extensions. Maybe it's a showstopper for you because you use other chrome extensions that you don't trust. Here's an idea -- we could offer the client as a standalone application with embedded Chrome. Then you can have your untrusted browser for all your normal browsing purposes, and a separate Scramble app.
I have no idea what you mean about a bookmarklet bypassing the cryptosystem. Are you suggesting that a user clicking on a malicious bookmarklet can thwart security? The user can always thwart his own security.
Yes it is. As I said you'll need a majority-wins system, i.e. the list of revoked certs is signed by a majority of the signature committee members. Using a window is wide open to attack, it has no redeaming features.
> It's enough for me ...
Unfortunately, "it works on my computer" is not going to cut it. I use a few browser extensions, but now those extensions' own update mechanisms can be used to attack your cryptosystem - even a "good" extension could be hijacked this way. That gives me a lot to worry about...
My point with bookmarklets was that many bookmarklets pull down code from an external server and inject it into the local page, so if the user makes use of any booklets as part of their email workflow then those bookmarklet sites now become attack vectors for your cryptosystem. Likewise, browser 0-days are also attack vectors for your cryptosystem which would not be present in say, a stand-alone client. The attack surface area of a browser is huge.
1. We could require the signatures to be recent, and if there are any certificates that need to be revoked, we could require that all signers include that information in the data signed. What do you think?
2. If other hostile browser extensions can hijack the validation process, then the only solution is to not have other browser extensions. Paranoid users who need strong security should boot from a fixed image that has a vetted browser with only one browser extension already installed.