YahooArchive / end-to-end

Use OpenPGP-based encryption in Yahoo mail.
http://yahoo.tumblr.com/post/113708033335/user-focused-security-end-to-end-encryption
Apache License 2.0
221 stars 40 forks source link

keyserver-signed-responses leaks into page's localStorage #5

Closed diracdeltas closed 9 years ago

diracdeltas commented 9 years ago

Responses from the keyserver are sometimes unintentionally put into the page's localStorage instead of Chrome extension localStorage. This isn't a security issue since the localStorage'd responses aren't used for anything right now and don't contain any sensitive information that the page doesn't already know, but it should still be fixed.

(Originally we were going to use a local index of keyserver responses to prune the keyring for keys that weren't sufficiently fresh and should therefore be untrusted.)