TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Contact form encrypts message with PGP before sending

28 pointsby joushxover 11 years ago

11 comments

fooycover 11 years ago
Is there any benefit of doing this on the client side?<p>The message is sent through HTTPS anyway.<p>If HTTPS was compromised, the javascript code signing the message, and the signing key, and everything related to handling the clear text message would be compromised too anyway.<p>This is redundant with HTTPS, but also useless if HTTPS is MITM.
评论 #6388978 未加载
评论 #6388973 未加载
y0ghur7_xxxover 11 years ago
The page loads jquery from google cdn, so at least google could inject js in the page and read the message before it gets encrypted.<p>I know, for a contact form this is very unlikely, but just from a security point of view, if I would write something like this, I would host js loaded by the page on my own server.
评论 #6389048 未加载
评论 #6389071 未加载
JosephRedfernover 11 years ago
It must be suck to be Johannes right now... I wonder how many emails containing random gibberish he is receiving?
评论 #6389064 未加载
eliover 11 years ago
This idea (encryption in javascript in a regular web browser) comes up very often on HN. It&#x27;s not a good idea. Since I have no way to trust&#x2F;verify that the encryption code itself has not been tampered with (beyond HTTPS) then it is only secure as HTTPS.<p>You&#x27;ve added a fair bit of complexity for no specific benefit; likely a net loss in terms of security.
评论 #6389390 未加载
mfwoodsover 11 years ago
I&#x27;m not sure what this adds over applying PGP on the server?<p>The way to intercept the message with the server doing PGP would be to either MITM the connection or breach into the server to intercept before encryption.<p>In both cases you could just as well modify the javascript served to the browser to defeat the PGP done in the browser as well.
评论 #6389018 未加载
cheyneover 11 years ago
Nice.. You can also do in browser client and sever side encryption now with <a href="https://www.noteshred.com" rel="nofollow">https:&#x2F;&#x2F;www.noteshred.com</a><p>See <a href="https://www.noteshred.com/client-side-encryption" rel="nofollow">https:&#x2F;&#x2F;www.noteshred.com&#x2F;client-side-encryption</a>
sambeauover 11 years ago
I&#x27;d never seen SocialSharePrivacy either (It&#x27;s linked in the page code), but it&#x27;s an interesting idea:<p><a href="http://panzi.github.io/SocialSharePrivacy/" rel="nofollow">http:&#x2F;&#x2F;panzi.github.io&#x2F;SocialSharePrivacy&#x2F;</a>
aluhutover 11 years ago
I love the usability of this.<p>I hope the issue of usability gets more attention in future security tool development.
st00pidover 11 years ago
google cannot translate his form. Why not? If I can see it, so can google.
评论 #6389181 未加载
mschuster91over 11 years ago
Nice, but how did you port openpgp to Javascript?
评论 #6388894 未加载
rorrr2over 11 years ago
And where&#x27;s the key stored on the client and how is it shared with the server?<p>I&#x27;m too lazy to parse their JS code.
评论 #6388954 未加载
评论 #6388961 未加载