The document discusses end-to-end encryption in web browsers using OpenPGP.js. It outlines the strengths and pitfalls of encryption in browsers, and how to mitigate risks like side channels and third party JavaScript. The document recommends using proven encryption standards like OpenPGP instead of rolling your own, and provides an overview of how Public-key cryptography works with PGP including encryption, decryption, signing and verification of messages. It promotes the Envkey service for encrypted key storage and configuration and seeks beta testers and React developers.

1. Zero Knowledge
End-to-end encryption in the browser with
OpenPGP.js
dane@envkey.com
@danenania

2. What’s encryption?

3. What’s end-to-end encryption?

4. Why use end-to-end encryption?
• Respect user privacy
• Prevent malicious exposure
• Prevent accidental exposure
• Avoid legal demands

5. Why not use end-to-end encryption?
• More difficult to code
• Server can’t do much with encrypted data

6. Why I use end-to-end encryption
• Envkey - encrypted vault for api keys and configuration
• https://www.envkey.com

7. End-to-end encryption in the browser
BROWSER STRENGTHS
• Great for users
• Great for developers
• Single platform, simple codebase, web languages
• Ubiquitous, no install, any device

8. End-to-end encryption in the browser
BROWSER PITFALLS
• Browser can be a dangerous environment for crypto
• Host compromise = game over
• Side channels
• xss, 3rd party js, extensions

9. End-to-end encryption in the browser
MITIGATING PITFALLS
• Content security policy (CSP)
• Static files / CDN / API
• Precompile 3rd party js dependencies
• Browser extensions / native apps

10. First rule of encryption logic
• Don’t implement your own encryption logic!
• Don’t touch primitives—use high level interfaces
• Use old, boring, proven standards and libraries

11. PGP, OpenPGP, OpenPGP.js
• PGP = Pretty Good Privacy — Phil Zimmerman 1991
• OpenPGP = opensource, standardized, no patents
• OpenPGP.js = js implementation of OpenPGP standard

12. PGP protocol
• Private key passphrase

13. PGP encryption / decryption

14. PGP signing / verification
• Encryption = privacy
• Signing = authenticity

15. Building PGP into your app
• Balance ux and security
• User auth and key generation
• Key management
• Key storage and retrieval
• Trusting public keys

16. Thank you!
• dane@envkey.com
• @danenania
• https://www.envkey.com
• Looking for:
• Envkey beta testers, React/Redux dev