My weekend project - AES encryption for Gmail or anything else • Hacker News Board

My weekend project - AES encryption for Gmail or anything else

#1

Post by eran » Tue, Jun 14, 2011, 1:32 PM UTC

My weekend project - AES encryption for Gmail or anything else
encipher.it

Re: My weekend project - AES encryption for Gmail or anything else

#2

Post by zitterbewegung » Tue, Jun 14, 2011, 2:14 PM UTC

Thats pretty neat since you have of the encryption done client side. Which mode of AES do you use?

Re: My weekend project - AES encryption for Gmail or anything else

#3

Post by eran » Tue, Jun 14, 2011, 2:22 PM UTC

zitterbewegung wrote: post #2

Thats pretty neat since you have of the encryption done client side. Which mode of AES do you use?

I use counter mode with 256 bit key Key is generated as sha256 hash of the user password

Re: My weekend project - AES encryption for Gmail or anything else

#4

Post by e-dard » Tue, Jun 14, 2011, 2:34 PM UTC

This is neat. Would it be possible to extend it such that you could drop a key file into the password box to do the encryption/decryption?

Re: My weekend project - AES encryption for Gmail or anything else

#5

Post by scrrr » Tue, Jun 14, 2011, 2:36 PM UTC

Very cool. Something like that for GPG encrypted emails would be great.

Re: My weekend project - AES encryption for Gmail or anything else

#6

Post by megamark16 » Tue, Jun 14, 2011, 2:38 PM UTC

This is great, I was just thinking the other day that it should be possible to encrypt gmail messages. Now you should make it possible to encrypt GChat messages automatically when I hit Send, and then decrypt them when they are received, that way they are encrypted end to end, instead of just between my browser and the server :-)

Re: My weekend project - AES encryption for Gmail or anything else

#7

Post by pixdamix » Tue, Jun 14, 2011, 2:42 PM UTC

    javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})();

You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ?

Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

Re: My weekend project - AES encryption for Gmail or anything else

#8

Post by eran » Tue, Jun 14, 2011, 2:44 PM UTC

e-dard wrote: post #4

This is neat. Would it be possible to extend it such that you could drop a key file into the password box to do the encryption/decryption?

Sure, but on modern browsers only (utilizing html5 file API). I am thinking about implementing RSA private key generation and online public key registry in future.

Re: My weekend project - AES encryption for Gmail or anything else

#9

Post by jvehent » Tue, Jun 14, 2011, 2:51 PM UTC

Nicely done. Roundcubemail has been struggling with email encryption for a while now. I would love to see you solution in a plugin: http://trac.roundcube.net/wiki/Plugin_Repository

Re: My weekend project - AES encryption for Gmail or anything else

#10

Post by eran » Tue, Jun 14, 2011, 2:56 PM UTC

pixdamix wrote: post #7

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.