Ask HN: Why doesn't someone provide JS encrypted webmail • Hacker News Board

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#11

Post by baltcode » Mon, Oct 04, 2010, 3:00 PM UTC

scrrr wrote: post #10

baltcode wrote: post #9

Earlier quoted context omitted.

If the private keys were stored pass-phrase encrypted it could work, and the weakest link of your private key/passphrase defines your security.

Yes but then you'd also have to store them across all installed clients/browsers and, when accessing from another computer, first transport the keys to that computer. That's why I think public keys would be the user-friendly way. Public = Only passphrase protects the key.

Right, that's what I meant actually. It seems like something that should already exist.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#12

Post by jessor » Mon, Oct 04, 2010, 3:03 PM UTC

I rememember there was someone on HN working on that a few years back. There was a nice discussion around it. I can't find the thread, perhaps someone else has better luck?

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#13

Post by fauigerzigerk » Mon, Oct 04, 2010, 3:11 PM UTC

Probably because it's a feature, not a viable business of its own. So existing web mail providers would have to do it, but they won't because it runs counter to their ad targeting practices.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#14

Post by retube » Mon, Oct 04, 2010, 3:17 PM UTC

I was thinking something similar recently. Not necessarily a web-app, but an app that encrypted message in the client, and was only decrypted on receipt. So even if the mail/message server/store was hacked, none of the messages would be readable.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#15

Post by limmeau » Mon, Oct 04, 2010, 3:22 PM UTC

baltcode wrote: post #8

limmeau wrote: post #5

What keeps the webmail company from supplying you with modified client-side JS code which forwards the keys you enter to $three_letter_agency?

Exactly, and I think that's a potential problem with hushmail (but those guys are to be commended for some honesty). How about a number of independent, hacker type, or FSF type communities certify the client side JS through md5 digests on the client side code or the like?

But how do I verify that the JS code being served to me in this moment is the version audited by the trusted party? AFAIK, mainstream browsers have no button to compute a hash over the contents of a website.

(And it's not just reusable JS libraries one would have to audit and checksum; the HTML code of individually rendered message pages could also contain JS code to subvert the security).

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#16

Post by zokier » Mon, Oct 04, 2010, 3:28 PM UTC

A GnuPGP-extension for Firefox (or Chrome), enabling encrypting or signing any text boxes. Sounds possible, don't know how well it would react with rich editing forms.

edit: complemented with a web-service storing your keys in the 'cloud'.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#17

Post by retube » Mon, Oct 04, 2010, 3:29 PM UTC

baltcode wrote: post #4

hendler wrote: post #2

There are grease monkey scripts that do this. Maybe because there is very little demand?

If more people became aware how much of their profile resides with ISP's, DNS providers, and email hosts, I think many would prefer such a thing. Google, by the way is a DNS provider, search gateway, email host, AND an advertiser. It might be popular if it was free (you can still have some advertising), and actually secure. I'd imagine at least a portion of the hacker community would gravitate to it. Are you talking…

That link looks like it could be what the OP is after. The _only_ caveat is you need recipients to tell you where their key is stored. It would be good if there was a service that stored public keys keyed by email.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#18

Post by rwolf » Mon, Oct 04, 2010, 3:29 PM UTC

FireGPG recently shut down, put used to provide this.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#19

Post by rwolf » Mon, Oct 04, 2010, 3:30 PM UTC

limmeau wrote: post #15

baltcode wrote: post #8

Earlier quoted context omitted.

Exactly, and I think that's a potential problem with hushmail (but those guys are to be commended for some honesty). How about a number of independent, hacker type, or FSF type communities certify the client side JS through md5 digests on the client side code or the like?

But how do I verify that the JS code being served to me in this moment is the version audited by the trusted party? AFAIK, mainstream browsers have no button to compute a hash over the contents of a website. (And it's not just reusable JS libraries one would have to audit and checksum; the HTML code of individually rendered message pages could also contain JS code to subvert the security).

Take a look at Aldo Cortesi's AppHash for one impl of verification of code right when it loads on the page.

Re: Ask HN: Why doesn't someone provide JS encrypted webmail

#20

Post by konad » Mon, Oct 04, 2010, 3:32 PM UTC

Our webmail installation encrypts the password on the client side, it's never sent in plain and we never know what it is. It's not hard, various crpyto libs are available for Javascript. I've written multiple HTML based login systems that never require knowledge of the plain text

Is that what you mean ?

Edit: Oh, you mean we never know the plaintext of the email.

You mean like this : http://www.hanewin.net/encrypt/

http://46dogs.blogspot.com/2007/11/encrypting-to-pgp-gnupg-g...

http://stackoverflow.com/questions/2802541/pgp-encryption-in...

tl;dr - too slow