Show HN: Exchange end-to-end encrypted emails with anybody(github.com)
github.com
Show HN: Exchange end-to-end encrypted emails with anybody
https://github.com/tutao/tutanota
2 comments
Hm, encryption within the browser... can this be secure? Any pros/cons?
This is how we mitigate these challenges: 1. We use the Fortuna algorithm to generate strong random numbers, seeded with crypto.getRandomValues(), mouse events, key events, ping times, and the state of the random generator of previous sessions. 2. We install the application to the browser cache. A reload only happens upon releasing an application update and the user gets notified automatically. Alternatively you can run your own application locally (see github). The download of the application is secured with SSL and DANE. 3. XSS: We use google-caja to mitigate XSS attacks and will introduce Content Security Policy (CSP) within a few months. Any further concerns, just ask!