Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My weekend project - AES encryption for Gmail or anything else

encipher.it

Post reply on HN
Print view View original

21–30 of 71 posts

Re: My weekend project - AES encryption for Gmail or anything else

#21

Post by eran »

pixdamix wrote: post #17
eran wrote: post #10

Earlier quoted context omitted.

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

You would be able to get past 2048bytes using mozilla or chromium See there: https://www.squarefree.com/bookmarklets/limits.html I just tested a 1Mb bookmarlet on chromium and it works.

Thank you for link, very interesting stats. FF also has reasonable URL limit. At least for some browsers I can do it.

Re: My weekend project - AES encryption for Gmail or anything else

#22

Post by jgrahamc »

Your key derivation function is pretty weak. Looking at your code you are doing SHA256(password entered by user). You should take a look at using http://en.wikipedia.org/wiki/PBKDF2 for the key derivation. SHA256 is really fast and given that you are getting entropy from some user entered password (which is likely to be badly chosen) you want something _slow_ to derive the key. Hence PBKDF2 with lots of iterations.

Re: My weekend project - AES encryption for Gmail or anything else

#24

Post by bdhe »

tptacek wrote: post #13
eran wrote: post #3

Earlier quoted context omitted.

I use counter mode with 256 bit key Key is generated as sha256 hash of the user password

That's also not a secure way of generating an AES key; those crypto keys can be cracked quickly. The problem you're trying to solve is the entire reason for PBKDF2. You should also use SJCL's AES.

You should also use SJCL's AES.

Here's the link: http://bitwiseshiftleft.github.com/sjcl/

Re: My weekend project - AES encryption for Gmail or anything else

#26

Post by eran »

dedward wrote: post #19
eran wrote: post #10

Earlier quoted context omitted.

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Don't do your self the disservice of self-signed - you can get a free cert from startssl. The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....) Just hit up startssl and get a real certificate... it's that easy. No strings attached. (Repeati…

Thank you for advice about cert service! Awesome. Will request SSL cert right now. I consciously left scripts uncompressed, so anybody can look what going on behind the scene. Also, I'll publish source code on github as soon as clean it up. Then I make compressed version.

Re: My weekend project - AES encryption for Gmail or anything else

#28

Post by mkelly »

megamark16 wrote: post #6

This is great, I was just thinking the other day that it should be possible to encrypt gmail messages. Now you should make it possible to encrypt GChat messages automatically when I hit Send, and then decrypt them when they are received, that way they are encrypted end to end, instead of just between my browser and the server :-)

OTR supports this for pidgin, and has a proxy for other clients: http://www.cypherpunks.ca/otr/

Re: My weekend project - AES encryption for Gmail or anything else

#29

Post by nextparadigms »

tptacek wrote: post #12
eran wrote: post #10

Earlier quoted context omitted.

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Even if you could somehow minify all of AES into a bookmarklet, you'd still lose any time any page this ran from requested HTML or JS from a non-HTTPS link, since any of those requests could poison the runtime.

Would using SPDY help?

Re: My weekend project - AES encryption for Gmail or anything else

#30

Post by Erwin »

Note that Gmail automatically saves your draft as you type it. So while this will offer some protection for the message while it's in transit from Google's server to your destination, your unencrypted message draft will still be sent to Google's servers (and given Google Apps' distributed architecture, I'm not sure you can determine where that unencrypted copy could end up or when it'd be erased).

Perhaps a way around that could be to enhance a text input field so that only the final encrypted message is written to it, so Google's app does not see the plain text.

Post reply on HN