> Also, even if it's [on] TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious.
It seems like no matter how you install the software, you likely have to put at least that level of trust in them. Unless you run it in its own VM or other sandbox, of course.
> Obviously, to do stuff like this, you need to generate certificates. The reasonable way to do that in 2020 is with LetsEncrypt. We do that for our users automatically, but “it just works” makes for a pretty boring writeup, so let’s see how complicated and meandering I can make this.
> 2) It has a free, optional hosted service that stores encrypted passwords with pure client-side decryption, so you can get your passwords from any web-enabled device without having to trust the host.
This is an unbelievably audacious security shell game; I can't really believe this nonsense idea has somehow managed to gain traction.
The server is ephemerally delivering the code that supposedly encrypts your content securely.
> Having seen it work I believe PKI can be practical at scale. And this is why I'd hoped a chat app might break some ground here.
If you believe that this webpage was delivered securely to your computer, then PKI might be practical. Of course, there are a few implementation details with that PKI.
Well, apart from the major cloud-breaking side-channel security issues.
reply