I think there is a market for someone to provide client side passphrase encrypted webmail, that is truly secure both from intruders and the mail hosting servers. Why don't webmail companies or a startup provide that?
Ask HN: Why doesn't someone provide JS encrypted webmail
1–10 of 65 posts
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#2There are grease monkey scripts that do this. Maybe because there is very little demand?
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#3I suspect because nobody can be bothered to encrypt mail anyway? I've tried to establish pgp links with friends several times, but eventually we always fell back to unencrypted mails.
Of course some super-companies might require encrypted mail, but that might not be a good enough use case to base a business on.
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#4There are grease monkey scripts that do this. Maybe because there is very little demand?
If more people became aware how much of their profile resides with ISP's, DNS providers, and email hosts, I think many would prefer such a thing. Google, by the way is a DNS provider, search gateway, email host, AND an advertiser. It might be popular if it was free (you can still have some advertising), and actually secure. I'd imagine at least a portion of the hacker community would gravitate to it.
Are you talking about this? http://www.langenhoven.com/code/emailencrypt/gmailencrypt.ph...
I'll check it out, though I thought it had some issues with the latest version of FF.
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#5What keeps the webmail company from supplying you with modified client-side JS code which forwards the keys you enter to $three_letter_agency?
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#6I suspect because nobody can be bothered to encrypt mail anyway? I've tried to establish pgp links with friends several times, but eventually we always fell back to unencrypted mails. Of course some super-companies might require encrypted mail, but that might not be a good enough use case to base a business on.
I think people don't use pgp because you have to install a client. People want to be able to access their mail from their home PC, work PC, laptop, friend's laptop and the library. Also, we want to remember our own pass-phrase rather than a private/public key.
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#7Good question. Right now I guess from a cryptographer's point of view all our emails are basically as public as Twitter messages, if anyone cares to read them.
Technically I think a purely passphrase-encrypted webmail would not be very secure, because if you used an asymmetric algorithm, the private keys would no longer be private, and if you used a symmetric algorithm you'd either have to change the pass-phrase each time or deal with a key-vulnerability. But I might be wrong.
Finally the demand could probably be created if it were implemented in a user-friendly way. I think it has to, somehow, eventually. It will not be difficult to convince people to use it once it works in a simple, transparent way. After all, everyone got used to logging in everywhere, as well.
In the long run, now matter how cool clients like GMail are, we should not leave our private communication to others and especially not to companies.
Perhaps it requires a person similar to Mark Shuttleworth with a lot of resources and a philantropic drive to start thinking about a solution.
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#8What keeps the webmail company from supplying you with modified client-side JS code which forwards the keys you enter to $three_letter_agency?
Exactly, and I think that's a potential problem with hushmail (but those guys are to be commended for some honesty). How about a number of independent, hacker type, or FSF type communities certify the client side JS through md5 digests on the client side code or the like?
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#9Good question. Right now I guess from a cryptographer's point of view all our emails are basically as public as Twitter messages, if anyone cares to read them. Technically I think a purely passphrase-encrypted webmail would not be very secure, because if you used an asymmetric algorithm, the private keys would no longer be private, and if you used a symmetric algorithm you'd either have to change the pass-phrase each…
If the private keys were stored pass-phrase encrypted it could work, and the weakest link of your private key/passphrase defines your security.
Re: Ask HN: Why doesn't someone provide JS encrypted webmail
#10Good question. Right now I guess from a cryptographer's point of view all our emails are basically as public as Twitter messages, if anyone cares to read them. Technically I think a purely passphrase-encrypted webmail would not be very secure, because if you used an asymmetric algorithm, the private keys would no longer be private, and if you used a symmetric algorithm you'd either have to change the pass-phrase each…
If the private keys were stored pass-phrase encrypted it could work, and the weakest link of your private key/passphrase defines your security.
Yes but then you'd also have to store them across all installed clients/browsers and, when accessing from another computer, first transport the keys to that computer.
That's why I think public keys would be the user-friendly way. Public = Only passphrase protects the key.