kingzero
Re:Show HN: End-to-end encrypted email, based in Switzerland
on Friday May 16, 2014 @04:51PM (#7757841)
> Can we recognize that this is a good first step, and definitely constitutes a huge improvement over gmail/yahoo type webmail solutions?
No its not. "Browser crypto" in the form of JS is broken. There are many different possible attacks. So a false sense of security is actually worse then no security at all.
Re:DNSSEC surpasses 50% of root domains
on Friday January 24, 2014 @09:32AM (#7114999)
More on this topic can be found in this talk by djb.
Re:Good fun with bad crypto
on Thursday January 16, 2014 @10:00AM (#7069684)
Same here. So i checked what ciphersuits they use.
TLS_RSA_WITH_RC4_128_SHA
Too bad they cant correctly set up their servers ...
Re:Bing now supports https
on Saturday January 11, 2014 @03:49PM (#7043685)
Before, the https version of bing only showed a blank page. Seems like MS finally fixed it.
Re:Scramble.io: secure email for everyone
on Tuesday November 05, 2013 @02:36PM (#6677561)
> No, as explained in the writeup, the server stores your private key encrypted with your passphrase. The server never sees your passphrase, or your private key.
The only place a private key belongs to is the users machine (preferably somewhere without internet access).
Re:Scramble.io: secure email for everyone
on Tuesday November 05, 2013 @02:24PM (#6677457)
> As mentioned in the writeup, there's a beautiful way you can protect even non-power-users. Because the extension downloads and verifies the webapp HTML, CSS and JS every time it runs, the web app is constantly being validated.
Imagine the following. An Attacker manages to hijack your server. They fingerprint[1] the browsers of each user and only send malicious JS to certain users that dont use your extension. No one will ever know, that they have been compromised.