[WO-03-014] Avoid unsinged content spoofing attack
|8 years ago|
|.elasticbeanstalk||9 years ago|
|config||9 years ago|
|res||8 years ago|
|src||8 years ago|
|test||8 years ago|
|.gitignore||9 years ago|
|.jshintrc||8 years ago|
|.travis.yml||8 years ago|
|Gruntfile.js||8 years ago|
|LICENSE.txt||9 years ago|
|README.md||8 years ago|
|package.json||8 years ago|
|server.js||8 years ago|
You can read about product features and our future roadmap in our FAQ.
Privacy and Security
We take the privacy of your data very seriously. Here are some of the technical details:
Messages are encrypted end-to-end using the OpenPGP standard. This means that only you and the recipient can read your mail. Your messages and private PGP key are stored only on your computer (in IndexedDB).
Users have the option to use encrypted private key sync if they want to use Whiteout on multiple devices.
Content Security Policy (CSP) is enforced to prevent injection attacks.
HTML mails are sanitized with DOMPurify and are rendered in a sandboxed iframe.
Displaying mail images is optional and opt-in by default.
Like most native email clients, whiteout mail uses raw TCP sockets to communicate directly with your mail server via IMAP/SMTP. TLS is used to protect your password and message data in transit.
The app is deployed as a signed Chrome Packaged App with auditable static versions in order to prevent problems with host-based security.
The app can also be used from any modern web browser in environments where installing an app is not possible (e.g. a locked down corporate desktop). The IMAP/SMTP TLS sessions are still terminated in the user's browser using JS crypto (Forge), but the encrypted TLS payload is proxied via socket.io, due to the lack of raw sockets in the browser. Please keep in mind that this mode of operation is not as secure as using the signed packaged app, since users must trust the webserver to deliver the correct code. This mode will still protect user against passive attacks like wiretapping (since PGP and TLS are still applied in the user's browser), but not against active attacks from the webserver. So it's best to decide which threat model applies to you.
Reporting bugs and feature requests
We will launch a bug bounty program later on for independent security researchers. If you find any security vulnerabilities, don't hesitate to contact us email@example.com.
You can also just create an issue on GitHub if you're missing a feature or just want to give us feedback. It would be much appreciated!
You can download a prebuilt bundle under releases or build your own from source (requires node.js, grunt and sass):
npm install && npm test
This will download all dependencies, run the tests and build the Chrome Packaged App bundle release/whiteout-mail_DEV.zip which can be installed under chrome://extensions in developer mode.
For development you can start a connect dev server:
Releasing Chrome App
grunt release-test --release=0.0.0.x grunt release-stable --release=0.x.0
Deploying Web App & Selfhosting
The App can be used either as a Chrome Packaged App or just by hosting it on your own trusted web server. You can build the app from source.
Build from source
Clone the git repository
git clone https://github.com/whiteout-io/mail-html5.git
Build and generate the
npm install && grunt
Running the server
To test the server, start it in development mode (without SSL):
node server.js --dev
Navigate to http://localhost:8889 (or whatever port is set using the
PORT environment variable).
To start the server for production use (this automatically redirects to
A note on security: The app should not be used without SSL so it's best to set up a reverse proxy or Loadbalancer with your SSL certificates. If you are not sure how to do this it might be easier to use our managed web hosting or packaged apps under https://whiteout.io/#product.
You can limit incoming and outgoing connections to the socket.io proxy by setting the following environment variables:
# the web socket proxy listens to this port # if unset, defaults to 8889 PORT=12345 # the socket.io proxy accepts connections from these origins to tunnel them to tcp, # separate with commas # if unset, defaults to 'localhost:' + port INBOUND_ORIGINS='foo:1234,bar:569' # the socket.io proxy opens tcp connections with these ports to tunnel them to socket.io # separate with commas # if unset, defaults to '143,465,587,993' (25 is forbidden by default) OUTBOUND_PORTS='123,456,789'
To start the server in development mode (no forced HTTPS, iframe loads http content), run
node server.js --dev
The MIT License (MIT) Copyright (c) 2014 Whiteout Networks GmbH. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Third party libraries
We work together with existing open source projects wherever possible and contribute any changes we make back upstream. Many of theses libraries are licensed under an open source license. Here are some of them:
- email.js (MIT license): IMAP, SMTP, MIME-building and MIME-parsing engine