[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Ideas to securely implement PGP encryption/decryption



Thus spake Moritz Bartl (moritz@xxxxxxxxxxxxxx):

> On 10.10.2011 22:29, Fabio Pietrosanti (naif) wrote:
> > No code coming from the web would be allowed to interact with the
> > plug-in but the end-user will still have all the encryption features
> > under his power, usable in a modern web-based world.
> 
> The problem Robert and katmagic are referring to (read access to the
> DOM) can only be mitigated by disabling active scripting on the pages
> where GPG is used. The plugin probably would have to notify the user,
> then disable all scripting and reload the page, before executing GPG
> functionality. This does not help against the "read plaintext before
> encryption" attack, obviously.
> 
> At the moment, I cannot think of any attack vectors once you combine it
> with enabled Torbutton (or a stripped down Tor Browser) where active
> scripting/access to the DOM is disabled completely.

Actually, these attacks are generally prohibited by strong isolation
between the content script and the XUL script. In XUL, you can read
the ciphertext, extract it, decrypt it, and display it in a protected
XUL window without introducing risk, IF all steps are done properly.
There are some subtleties here involving special priviledge isolation
wrappers (via XPCSafeJSObjectWrapper and others), but there is no
fundamental reason that it is impossible. Just complicated and tricky,
in either NPAPI and XPCOM (but probably worse with NPAPI, because you
won't get the priviledge isolation wrappers for free like XPCOM).

The one exception is deception: One could imagine all manner of
clickjacking-esque games that could be designed by malicious
javascript to capture context clicks or mouseovers to create a fake
password menu. Authentication and decryption UI should be designed to
exist primarily outside of the content area for this reason.


-- 
Mike Perry
Mad Computer Scientist
fscked.org evil labs

Attachment: pgp2x_xciukvG.pgp
Description: PGP signature

_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk