Re: [lamps] S/MIME fix

[Phillip Hallam-Baker <[e-mail]>]

On Thu, May 17, 2018 at 11:37 AM, Adam Roach <[e-mail]> wrote:

> On 5/17/18 9:01 AM, Russ Housley wrote:
>
>> To create an analogous situation for secure email, you'd need to use
>>> webcrypto in a way that stored your private key in the browser
>>> (inaccessible to the page), and develop web standards that add some
>>> affordance for web pages to hand encrypted data to the browser in a way
>>> that causes the corresponding unencrypted data to be displayed to the user,
>>> but isolated from the web page completely (e.g., rendered into an iframe
>>> that the parent cannot inspect).
>>>
>> I am not following you.  I do not see the requirement to do anything with
>> webcrypto.  However, I completely agree with the need to isolate each
>> portion of the multi-part.
>>
>
> Presumably, we would need a means to generate a keypair, and to make the
> public key available to the webpage so that it can be conveyed to remote
> parties. That could be a new API, but it feels like something that could be
> added to webcrypto without much fuss. (I'll note that WebRTC did take the
> other approach, by defining an RTCPeerConnection.generateCertificate()
> method that is very roughly equivalent to window.crypto.subtle.generateKey(),
> but with the properties I describe above).
>
> Admittedly, this can all be done by the browser itself using local UI, but
> the general idea of the web platform is that you delegate only as little as
> is necessary to the browser. I mean, if you push enough of this to the
> local binary, and it becomes a full-fledged email client. ;)


​That was the CERN approach.

Netscape disagreed, threw JavaScript together in a fortnight and launched
it on the world with no consultation. We have been in damage control ever
since.

A modern Web browser is a Turing complete language for constructing thick
clients for the Web Services of your choice. I don't like the fact but it
is what it is.

I am composing this in Gmail right now. And there is my outlook client in
the window underneath. ​The Web browser is not just a full fledged email
client, it is the client of choice.