Comment by DaSHacka
4 hours ago
Especially when it's GP's own project lol
https://news.ycombinator.com/item?id=49330876
> On the other hand, I'm working on a prototype to completely throw away conventional email. Creating a system where you can simply spin your own physical mail box and node, and reach others at their unique address.
I gave it a deeper look and it bundles 500+ kB minified OpenPGP library in JavaScript, presumably to do all the encryption and key management logic.
Not saying it's necessarily malicious, but if I wanted to do malice this is exactly how I'd do it.
I thought the exact same thing and that's what I would do too(I didn't). This is from the official openpgp repository and you end up asking your self these things.
PGP is set up in a way where this wouldn't be that hard either. You could easily encrypt every message with a master key so that every PGP message sent would be decryptable. That's how group messaging works, everyone encrypts the same message with everyone's key. Otherwise you would not be able to read your own outbound main for instance.
The hardest thing you would have to do is hide the fact that your key exists inside the source code, as well as the instruction set to encrypt it with this key.