Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Roundcube Webmail 1.2.0 released with PGP support

roundcube.net

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Roundcube Webmail 1.2.0 released with PGP support

#51

Post by noinsight »

rmoriz wrote: post #15

I wish someone would do this for S/MIME. S/MIME has native support in many MUAs, even Mail.app on iOS. http://smime.io/ https://github.com/roundcube/roundcubemail/issues/4977

I'm waiting for Let's Encrypt to start offering S/MIME certificates.

Re: Roundcube Webmail 1.2.0 released with PGP support

#52

Post by dguido »

xrorre wrote: post #22

Here's an old XSS exploit for Roundcube from 2013: https://www.intelligentexploit.com/view-details.html?id=1696... I still use RC despite the long history of XSS attacks against it. Luckily RC uses progressive enhancement, so it still works with JS turned off. I just assume emails can still execute JS in 2016? Perhaps it's wrong of me to use RC with JS turned off as a preventative measure, but you have to adore that…

You're right. Before any integration of a server-side PGP key like this, they ought to have deployed some basic hygiene like a strict Content Security Policy (CSP) and a better sanitization library like HTMLpurifier. I don't trust webmail software, and definitely not PHP webmail software, to hold my keys for me otherwise.

Re: Roundcube Webmail 1.2.0 released with PGP support

#53

Post by jethro_tell »

ryanlol wrote: post #24
bechampion wrote: post #16

ha i remember long time ago chasing for the perfect webmail system.. before gmail of course. Horde,Roundcube, squirrel god... I've never found the perfect one!

How about OWA? Despite requiring windows, it's a pretty solid product.

It doesn't require Windows. It's a web app . . . that is pretty rough.

Re: Roundcube Webmail 1.2.0 released with PGP support

#54

Post by SquareWheel »

ryanl0l wrote: post #47
SquareWheel wrote: post #41

Earlier quoted context omitted.

Well, no. But that's not really end-to-end, is it? If the goal is to make E2E more accessible then eventually more emails will come in encrypted. Maybe Google will let users with the extension find each other, or Gmail might help coordinate that.

Sure, but I'd imagine that most email traffic is automated non-sensitive stuff (i.e. flight confirmations for example). That stuff is simply not going to be e2e encrypted any time soon, if ever. Are people going to start filling in their pubkeys when they book a flight? What about when they're at the airport and need to pull up the record locator on a different device? I'm sure more emails will start being encrypted,…

I'd give it time. People won't enter their public keys when booking a flight, but it might be associated with their email address automatically. I could see Google running a service like Keybase. Or even integrating it further into whatever the next hip "online identity" service is. Built in privacy would be a huge boon.

The flight company (or email sender they use) could then request your public key and send off your message. And with some common protocols and APIs the complexity could be largely abstracted away.

I wouldn't underestimate the technology. When you look at more complex systems like internet routing tables, these problems feel a lot more solvable. We already have the technology for most of this. The problem right now is making it accessible.

Re: Roundcube Webmail 1.2.0 released with PGP support

#56

Post by grinich »

rmoriz wrote: post #15

I wish someone would do this for S/MIME. S/MIME has native support in many MUAs, even Mail.app on iOS. http://smime.io/ https://github.com/roundcube/roundcubemail/issues/4977

Is S/MIME really that widely used? It seems to be sort of widely deployed, but not necessarily understood or required by users in secure environments.

Re: Roundcube Webmail 1.2.0 released with PGP support

#57

Post by grinich »

teekert wrote: post #21
embik wrote: post #6

For everyone who (like me) wondered what happened to "Roundcube Next", they released a statement 8 days ago[1] about it. Sounds like they had personal problems getting in the way. Glad to see the project is still alive. [1] https://www.indiegogo.com/projects/roundcube-next--2#/update...

Thanx for the update, I tweeted them repeatedly, never getting any reply. It looks pretty bad that the last tweet is so old. In the meantime, I've been using Nylas N1 (local mail client) and ownCloud mail (webmail), both have become pretty good!

Thanks for the kind words! (I work at Nylas.)

We actually have PGP support coming soon as well. ;)

Re: Roundcube Webmail 1.2.0 released with PGP support

#58

Post by mrmondo »

benbristow wrote: post #14

Rainloop already has this. http://www.rainloop.net/ Been using it for a year or so now, it's fantastic and has never let me down.

That does look nice, looks like they've come quite a way very quickly too. Still a little put off by the idea of host PHP apps for such critical systems but hats probably my internal bias towards using Ruby/Python/Go.
Post reply on HN