Skip to content
Hallway
0:00 / 0:00

#protonmail#e2ee#pgp

End-to-End Encryption in the Browser Impossible? - ProtonMail

LiveOverflow

949K subscribers • 11 videos on Hallway

YouTube
  • Recommended by 2 people: 2 in engineering communities.
  • May be out of date. Uploaded 7 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

91K views7 years ago2 recommendations

SecurityWeb developmentWeb and application securityCryptographyHTTP, REST and GraphQL

LiveOverflow analyzes whether web applications like ProtonMail can truly guarantee end-to-end encryption when the server delivers the JavaScript code.

A recent paper about ProtonMail's end-to-end encryption makes us wonder whether a web app can provide the strong guarantees its marketing promises. The important question is not PGP itself, but who delivers the JavaScript that performs the encryption. LEARN ON HEXTREE (ad) Learn hacking on Hextree: hextree.io/ Watch this video and more on Hextree: app.hextree.io/courses/yt-invalid-reports/threat-modeling Join the Hextree Discord: discord.gg/xgQpCQCpvy An Analysis of the ProtonMail Cryptographic Architecture - Nadim Kobeissi eprint.iacr.org/2018/1121 ProtonMail response: reddit.com/r/ProtonMail/comments/9yqxkh/an_analysis_of_the_p… CHAPTERS - A Serious Claim About ProtonMail's Encryption - PGP Works Until the Server Delivers the Code - ProtonMail's Response About Web Apps - Following the Trust Rabbit Hole - Why Mobile App Delivery Is Different - Threat Models, Opinions, and Product Claims - ProtonMail Already Assumes Its Server Can Be Compromised - Security Goals, Marketing, and Your Threat Model SUPPORT Per video: patreon.com/join/liveoverflow Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: youtube.com/LiveUnderflow Twitch: twitch.tv/LiveOverflow/ Twitter: twitter.com/LiveOverflow/ Instagram: instagram.com/LiveOverflow/ TikTok: tiktok.com/@liveoverflow_ LiveOverflow blog: liveoverflow.com/ Hextree blog (ad): hextree.io/blog #Cryptography (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.

Why it's here

2 people recommend this

What people say. Recommended as an explanation of why browser-delivered JavaScript limits the security guarantees of end-to-end encrypted web applications.

u/Ask-Alicein r/compsci • Recommends

On “CCI-Based Web Security: A Design Using PGP (1995) - 23 years later, still no common interface for trustable end-to-end encryption built into the browser”

Even with a custom key, there's nothing stopping them from stealing your key or your decrypted messages with javascript, as I'd assume the code that decrypts messages and handles the key is served by the server Check out this video that inspired this post: link to this video My initial thought was something like a closed shadow dom created by a browser extension, and though it may be possible to make decrypted text unreadable by XSS/attacker js in this way, it's not necessarily recommended, as for example the function that creates the closed shadow dom could potentially be overridden by an attacker. This is why I think it should be built into the browser. Something like TOR would be a good starting p…
8View on Reddit

u/Wavumin r/netsec • Recommends

End-to-End Encryption in the Browser Impossible? - ProtonMail
1View on Reddit