Hacker News Reader

Goes...out of scope.

I am suspicious that that's not really sufficient password protection. What protection do you have from an attack that provides access to your machine's address space? (or chrome's address space)?

I'd like to see the source code before I use this. If that sounds paranoid, it's because if I'm using crypto, it's because I'm concerned about snoopers.

--- edit - source got posted. Thanks!

View on HN

-nod- an attack with full access to chromes address space would grab the password in memory.

I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)

Could you mitigate that by having a separate process to do the crypto, which the plugin talks to by IPC? The separate process is then the one that prompts for the password.

This would also mean you don't have to reenter your password every time.

You're at zero right now because my finger slipped. Sorry about that.

Reply on news.ycombinator.com