Especially when it's GP's own project lol

https://news.ycombinator.com/item?id=49330876

> On the other hand, I'm working on a prototype to completely throw away conventional email. Creating a system where you can simply spin your own physical mail box and node, and reach others at their unique address.

▲

sph 20 hours ago | parent [-]

I gave it a deeper look and it bundles 500+ kB minified OpenPGP library in JavaScript, presumably to do all the encryption and key management logic.

Not saying it's necessarily malicious, but if I wanted to do malice this is exactly how I'd do it.

▲

smalltorch 19 hours ago | parent [-]

I thought the exact same thing and that's what I would do too(I didn't). This is from the official openpgp repository and you end up asking your self these things.

PGP is set up in a way where this wouldn't be that hard either. You could easily encrypt every message with a master key so that every PGP message sent would be decryptable. That's how group messaging works, everyone encrypts the same message with everyone's key. Otherwise you would not be able to read your own outbound main for instance.

The hardest thing you would have to do is hide the fact that your key exists inside the source code, as well as the instruction set to encrypt it with this key.

▲

sph 18 hours ago | parent [-]

If you want to do encryption the proper way on modern browser, look into https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...

	▲	smalltorch 18 hours ago \| parent [-]
		I'm aware of webcrypto, but decided PGP was more suitable. Mainly, the physical private key It's also been battle tested much longer then webcrypto. What makes it improper in your eyes?