Roundcube Webmail 1.2.0 released with PGP support • Hacker News Board

Re: Roundcube Webmail 1.2.0 released with PGP support

#21

Post by teekert » Mon, May 23, 2016, 12:31 PM UTC

embik wrote: post #6

For everyone who (like me) wondered what happened to "Roundcube Next", they released a statement 8 days ago[1] about it. Sounds like they had personal problems getting in the way. Glad to see the project is still alive. [1] https://www.indiegogo.com/projects/roundcube-next--2#/update...

Thanx for the update, I tweeted them repeatedly, never getting any reply. It looks pretty bad that the last tweet is so old. In the meantime, I've been using Nylas N1 (local mail client) and ownCloud mail (webmail), both have become pretty good!

Re: Roundcube Webmail 1.2.0 released with PGP support

#22

Post by xrorre » Mon, May 23, 2016, 12:36 PM UTC

Here's an old XSS exploit for Roundcube from 2013:

https://www.intelligentexploit.com/view-details.html?id=1696...

I still use RC despite the long history of XSS attacks against it. Luckily RC uses progressive enhancement, so it still works with JS turned off. I just assume emails can still execute JS in 2016? Perhaps it's wrong of me to use RC with JS turned off as a preventative measure, but you have to adore that user interface! It's the only reason I choose RC over other self-hosted email web apps (and there are few to choose from in this space). I like the simplicity of Squirrel-mail, but Roundcube looks and feels too good not to use.

Re: Roundcube Webmail 1.2.0 released with PGP support

#23

Post by ryanlol » Mon, May 23, 2016, 12:47 PM UTC

xrorre wrote: post #22

Here's an old XSS exploit for Roundcube from 2013: https://www.intelligentexploit.com/view-details.html?id=1696... I still use RC despite the long history of XSS attacks against it. Luckily RC uses progressive enhancement, so it still works with JS turned off. I just assume emails can still execute JS in 2016? Perhaps it's wrong of me to use RC with JS turned off as a preventative measure, but you have to adore that…

What about the various RCE bugs, do those not worry you?

Re: Roundcube Webmail 1.2.0 released with PGP support

#24

Post by ryanlol » Mon, May 23, 2016, 12:56 PM UTC

bechampion wrote: post #16

ha i remember long time ago chasing for the perfect webmail system.. before gmail of course. Horde,Roundcube, squirrel god... I've never found the perfect one!

How about OWA? Despite requiring windows, it's a pretty solid product.

Re: Roundcube Webmail 1.2.0 released with PGP support

#25

Post by xvilka » Mon, May 23, 2016, 12:57 PM UTC

I recommend to try also Mailpile [1], which was built with security in mind.

[1] https://www.mailpile.is/

Re: Roundcube Webmail 1.2.0 released with PGP support

#26

Post by bechampion » Mon, May 23, 2016, 1:05 PM UTC

ryanlol wrote: post #24

bechampion wrote: post #16

ha i remember long time ago chasing for the perfect webmail system.. before gmail of course. Horde,Roundcube, squirrel god... I've never found the perfect one!

How about OWA? Despite requiring windows, it's a pretty solid product.

Well, this quest I'm referring to was probably 2003/4 , I don't know what was the state of owa then.

Re: Roundcube Webmail 1.2.0 released with PGP support

#27

Post by Sephr » Mon, May 23, 2016, 1:08 PM UTC

mikekchar wrote: post #17

Sephr wrote: post #13

It's nice to hear about the server-side PGP support (searching!), although it's unfortunate that the client-side solution, Mailvelope (or more specifically, the OpenPGP.js library it uses), still doesn't support any ECC algorithms. Fortunately Google's End-to-End extension does support ECC algorithms (no idea if it integrates with Roundcube though), but it seems like it still isn't ready for production distribution o…

I may be wrong (and hope to be corrected!), but I think that End-to-End is never expected to be in the Chrome Web Store. I think they feel that this kind of encryption is too complicated for the average user. It's intended more for "power users" who already know that they want it.

They indicate in the GitHub repo that this should eventually be ready for the Chrome Web Store, so they definitely plan on distributing it there eventually.

Worst case, it reaches a more or less "finished" state and Google doesn't upload it to the CWS—anyone else can still upload it since it's Apache licensed. I doubt it will ever come to that though.

Re: Roundcube Webmail 1.2.0 released with PGP support

#28

Post by belorn » Mon, May 23, 2016, 1:12 PM UTC

xvilka wrote: post #25

I recommend to try also Mailpile [1], which was built with security in mind. [1] https://www.mailpile.is/

I will be doing that as soon the 1.0 release is out and available as a debian package. Any idea how stable the current beta version is?

Re: Roundcube Webmail 1.2.0 released with PGP support

#29

Post by bildung » Mon, May 23, 2016, 1:15 PM UTC

xvilka wrote: post #25

I recommend to try also Mailpile [1], which was built with security in mind. [1] https://www.mailpile.is/

As far as I understood Mailpile is a mail user agent, so not comparable. Roundcube runs on a server, Mailpile runs on your own computer.

Re: Roundcube Webmail 1.2.0 released with PGP support

#30

Post by Bombthecat » Mon, May 23, 2016, 1:35 PM UTC

ryanlol wrote: post #24

bechampion wrote: post #16

ha i remember long time ago chasing for the perfect webmail system.. before gmail of course. Horde,Roundcube, squirrel god... I've never found the perfect one!

How about OWA? Despite requiring windows, it's a pretty solid product.

Owa?