In T7972#209893, @tfry wrote:

In T7972#209892, @m.eik wrote:

i wonder if it's possible to add hash sums of the javascipt file to the manifest and have them checked when the panel is opened? this would make it impossible for the proxy to serve compromised web clients.

Outlook actually does something similar (as I found out while trying to make some modifications to the .js code). It seems to calculate a hash, when the manifest is registered, and then refuses to load a mismatching file. You have to remove and re-register the plugin in this case.

Other than stealing metadata and preventing communication and maybe sending evil emails on your behalf, I'm unsure what a hostile proxy can do. I'm not sure we should assume it is hostile.

In T7285#209655, @ebo wrote:

@svuorela Isn't this done already for KF6?

We also discussed emails that can't be decrypted. They are due to implementation details just currently skipped. They will also be so in the future as an implementation detail.