Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why doesn't someone provide JS encrypted webmail

news.ycombinator.com

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#61

Post by SriniK »

baltcode wrote: post #49
SriniK wrote: post #39

I have been working on this for few months now. It is a CR/FF/SF browser extension which should work with gmail/yahoomail/hotmail. Please get in touch with me if you like to be notified - skommoori (at) gmail.com Recently, I have pitched the idea to few people both in angel community and some of my friends and tc disrupt visitor friends that I met. As few users have mentioned in the comments, it really boils down to…

Great to know someone is working on it. If it is in C/C++, the user has to download a program, and it is not simple webmail. Secondly, what about the private keys? Do we have to remember them? The reason pgp has not caught on for most people is because we dont want to go through a complicated mail client installation. If your solution is simpler/easier to install, that's a plus. However, I should be able to access my…

It is an extension that you download for the browsers - Chrome/FF/Safari are targeted. Yes you can access your encrypted mail from your computer, friends computer, etc.. Generating and Managing keys and all other logistics are something I think we will add to the value of already existing OpenPGP protocol. I will definitely go through app signing and code verifying by outside agencies(so users are sure of authenticity)

My motto is, even grandma should be able start encrypting emails :)

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#62

Post by appl3star »

tptacek wrote: post #34

There are two very good reasons why nobody should bother doing this. First: browser Javascript is the most hostile possible environment in which to implement cryptography. From actual experience: you are better off trying to implement crypto in a microcontroller, with kilobyte-denominated space for code storage, no cold-start entropy, and a few tens of bytes headroom for negotiation. Seriously: do that first, before…

1) "Second: the security economics of mail drastically favor Google over anything you come up with, even if you're really good. That's because the cost of a sitewide compromise at Google is stratospheric."

This cannot be a serious answer: Some chinese already compromised Google a few months go - they stole the "Gaia" source code. Gaia is the single-sign-on solution for all Google services! Just because they are not unsing it on a big scale you can be sure there are people using exploits found from the source code to log into Google accounts.

2) "People who care about mail security but don't trust Google just VPN to a private mail server."

A VPN in general can be considered secure. If configured properly. Same for a mail server and for the network behind the VPN. In general: I would recommend a secure file sharing environment focussed on security & encryption. And no, that´s not Dropbox or box.net.

There is no better solution than GnuPG/PGP client encryption. Or at least partially secured file sharing offers like datainherit.com or cloudsafe.com

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#63

Post by tptacek »

appl3star wrote: post #62
tptacek wrote: post #34

There are two very good reasons why nobody should bother doing this. First: browser Javascript is the most hostile possible environment in which to implement cryptography. From actual experience: you are better off trying to implement crypto in a microcontroller, with kilobyte-denominated space for code storage, no cold-start entropy, and a few tens of bytes headroom for negotiation. Seriously: do that first, before…

1) "Second: the security economics of mail drastically favor Google over anything you come up with, even if you're really good. That's because the cost of a sitewide compromise at Google is stratospheric." This cannot be a serious answer: Some chinese already compromised Google a few months go - they stole the "Gaia" source code. Gaia is the single-sign-on solution for all Google services! Just because they are not u…

You think I trust "DSwiss.com", the "Swiss bank for information assets", founded in 2006, more than I trust the largest technology company in the world --- and presumably one of the top 10 spenders on software security worldwide?

Sorry, no, I don't. Maybe you can name one person I'd have heard of who has assessed any piece of their source code?

Post reply on HN