1. 1

    I’ve been thinking about this too. Nice to know that the signed pages webextension already exists!

    signed pages is not able to prevent the loading of the website even if the signature is invalid

    They should be able to implement this functionality for Firefox. They’re already using a blocking request filter, they definitely can prevent the page from being rendered if the check fails.

    the keys in localStorage

    Hm, why not just encrypt them with a key derived from the password? Or is there “remember password” functionality for convenience?

    1. 1

      the idea is when you’re logged in, your keys stay in localStorage, and if you reload the html file (and if it is possible that it could have been tampered with) you are logged out and have to enter your password again. Password auto-fill can leak your password to an adversary too so you need to disable that, which is a big inconvenience.

      1. 1

        What’s the point of using localStorage if you are logged out when you reload? Sharing the logged-in state across multiple browser tabs?

        1. 1

          Yes, this and also a soft reload (clicking a link or entering cryptpad.fr in the location bar) will hit the cache, only F5 flushes the cache. Something I forgot to mention in the blog is that verifying the cross-domain iframe html is kind of a pain since iframes don’t (yet) allow an integrity field. My solution was to load it manually first with fetch() api (which supports integrity) and then load it with the iframe afterwords and hope for a cache hit.

    1. 2

      I’m working on making CryptPad (open source encrypted collaboration https://cryptpad.fr/ ) more usable. It’s an uphill battle because we are developers (and crypto developers at that) so even though I know how important usability and design is, I’m still not able to make any decisions of value without a designer to hold my hand. It’s a learning experience.

      1. 3

        When he mentioned that Excel uses internationalized function names, it struck me that any programming language could do such a thing and we could even write automated translators to change keyword and API elements which have been internationalized. Seems like it could be something like a git checkout.

        1. 6

          On CryptpPad we chose not to use any kind of framework for mostly similar reasons. For us there is a realtime editing loop which must be fully synchronous otherwise a keystroke can slip in between read and write of the DOM which will cause lost characters. Furthermore we didn’t find any framework which seemed like it would last long enough and be flexible enough for our needs.

          We ended up using only vanilla javascript ES5 (no compiling) and requirejs which allows us to serve almost entirely immutable content with 1 year cache headers and the js which is in your browser is exactly what we wrote, even with the comments.

          1. 2

            https://github.com/cjdelisle/big_download same thing except the gzip data is generated on the fly with ~no CPU usage. nodejs/express app.