Kristian Fiskerstrand wrote:
Granted this whole discussion probably belongs somewhere else, but
since we're first on the topic, let me chime in my two cents.
First of all, any encryption done in a browser will at least have to
be done in a browser extension that does not auto-update. One thing is
whether one trusts a service today, but if tomorrow some completely
different JS can be injected (or only injected based on e.g. IP
address, or other identifiers for a specific user, which we have seen
some cases of) then it can't be trusted.
BIG ACK
Second, key validation. Your friends (or friends of anyone using the
service) would have to carry along a phone-book of fingerprint, key
types and sizes for each recipient. Other than the short key ID I
don't see anywhere where this website provide information useful for
key verification procedures.Not even after encryption; What happens if
there is a short keyid collision? and is there a way to verify the
structure of the encrypted message before sending? (similar to gnupg's
--list-packets)
For example: https://encrypt.to/0xDEADBEEF comes to mind right away.
How does the code handle keys with multiple email addresses? Does it
mail-bomb
them all?