The FAQ describes how the data center is using super-sophisticated security. Why is this necessary if the data is encrypted at the client? (perhaps I'm missing something about the threat model).
Edit: See link below: https://privateforms.net/embed/rNKlzL
So you get jquery, moment, bootstrap + datatimepicker, kbpgp and a few lines of glue to use kbpgp to send and XMLHttpRequest, basically:
kbpgp.KeyManager.import_from_armored_pgp({
armored: '-----BEGIN PGP PUBLIC KEY BLOCK-----\n' +
/* key */
'-----END PGP PUBLIC KEY BLOCK-----'},
function(err, keyManager) {
kbpgp.box({msg: '**form=data**', encrypt_for: keyManager},
function(err, encryptedString, encryptedBuffer) {
//send result;
}
);
});Securing the data center is the least of your worries for such an attacker. I'd detail additional attacks that all subvert the encryption process:
1. Compromise the site's private SSL certificate. This allows the possibility of MITM attacks. There is some evidence that NSA is already mounting such attacks on the Internet.
2. Malware on the client-side. A compromised browser, or a compromised OS.
3. The US government mandating that NSA installs hidden firmware on all data center servers.
I argue that strong semantics are extremely important when building secure services. I thought their service offers one such semantic: client-side form data encryption. They do not offer JS code integrity or any guarantees about the client-side encryption not being subverted.
By telling people about datacenter security and then calling it a "a detail that some people who are security-conscious might care about" or "data center security probably does matter", you continue to raise the fog of confusion in people's minds. Instead, the FAQ could educate the users and separate client-side encryption (which is what the service offers) from client-side code integrity (which the service does not offer).
If you start telling me that I'm paying for security measures that have no effect on your service security guarantees, I think you're selling snake-oil.
At this point, I'm very reluctant to trust my data to your service.
You should use PF if you trust them not to be compromised (hacked or be malicious) and not to backdoor the software. It shouldn't hinge on the client side crypto.