Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Maybe encryption/decryption could be performed in a separate, isolated process, which stack would never be sent? It seems like Chrome multiprocess architecture could allow for this.


Under "JavaScript crypto has very real risk of side-channel attacks": End-To-End’s crypto operations are performed in a different process from the web apps it interacts with.


If process isolation is already done, disabling stack dumps for crypto processes seems like a logical next step that shouldn't be hard to accomplish.


It's probably relying on normal process isolation (and extensions run in a different process), but in order to disable stack dumps for it, you'd have to have some way of indicating "this process is special", which rules out treating it like any other extension.

Maybe there could be some new extension permission for "encryption extension" or something, but it's possible that could be abused...


There's already permissions that are only usable by Google's own extensions, so they could do something like that.


I'd agree that is better...but I am guessing that Google doesn't want to build this functionality directly into Chrome. Anyone who isn't Google wouldn't have the option for Chrome...Chromium isn't 'mainstream' :(

EDIT: Maybe the other guy is right and you didn't mean baking it into the browser. xD




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: