Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End-To-End – OpenPGP Chrome extension from Google

code.google.com

Post reply on HN
Print view View original

41–50 of 173 posts

Re: End-To-End – OpenPGP Chrome extension from Google

#41

Post by latj »

tlrobinson wrote: post #17
opendais wrote: post #4

"Please note that enabling Chrome’s "Automatically send usage statistics and crash reports to Google" means that, in the event of a crash, parts of memory containing private key material might be sent to Google." I hope that has more than a FAQ warning when they release it to the Chrome Store. Otherwise....:/ It isn't perfect but it is probably the best in-browser option given the constraints available.

Does this also mean parts of memory containing, say, passwords could be send to Google?

This "end to end" encryption happens in the browser. Google is the browser. Google dont need your keys, they have the plain text.

Re: End-To-End – OpenPGP Chrome extension from Google

#42

Post by mikecb »

nilved wrote: post #20
specialp wrote: post #12

Earlier quoted context omitted.

Google is not mining all networks for cleartext email. They are mining gmail which they have control of the "end". This is a huge advantage for Google as ISPs are starting to offer ability to advertise to end users by mining traffic.

"End-to-end" implies that Gmail won't be able to read your emails. That means that this software and Gmail, one of Google's largest products, are going to be competing. One of them needs to adapt or die: if this software isn't backdoored or vulnerable right now, it will either be shuttered, backdoored or made vulnerable in the future. (Certainly Gmail is of tangible, financial good to them: it's more likely for them…

Someone else pointed out that subject lines will not be encrypted.

Re: End-To-End – OpenPGP Chrome extension from Google

#43

Post by uulbiy »

nilved wrote: post #10

Isn't this contrary to Google's goals as an advertising business? If people are using end-to-end encryption, they won't have cleartext emails to mine, &c. I need to wonder what the catch is, because there is definitely one: does Google own all the keys, or does Google secretly own all the keys?

Let me start by answering another question.

Why do people use webmail? Because it's convenient. If I use a client like Thunderbird and download all my emails then if I want to find one of them I have to search for it on the device that I downloaded it. Of course I could upload my emails on a server and access them from other devices but it's a hassle. Webmail solves this problem. Additionally, why competent, smart, technical people very often don't use digital signatures? Same as before plus if you want to use your emails in other devices you have to transfer your secret keys and remember their passphrases.

The transfer of the secret keys is what will keep the usage of this extension low. Therefore, Google succeeds in gaining more trust while offering something that you can already achieve on your own using other software like Thunderbird with the Enigmail extension. Also, note that even by using a digital signature you hide only the emails that you choose to send encrypted and those that you receive encrypted by the senders. I use digital signatures every day, I usually send and receive signed messages. However, the percentage of unencrypted messages in my inbox is probably more than 99%.

Re: End-To-End – OpenPGP Chrome extension from Google

#44

Post by opendais »

mixedbit wrote: post #40
opendais wrote: post #4

"Please note that enabling Chrome’s "Automatically send usage statistics and crash reports to Google" means that, in the event of a crash, parts of memory containing private key material might be sent to Google." I hope that has more than a FAQ warning when they release it to the Chrome Store. Otherwise....:/ It isn't perfect but it is probably the best in-browser option given the constraints available.

Maybe encryption/decryption could be performed in a separate, isolated process, which stack would never be sent? It seems like Chrome multiprocess architecture could allow for this.

I'd agree that is better...but I am guessing that Google doesn't want to build this functionality directly into Chrome. Anyone who isn't Google wouldn't have the option for Chrome...Chromium isn't 'mainstream' :(

EDIT: Maybe the other guy is right and you didn't mean baking it into the browser. xD

Re: End-To-End – OpenPGP Chrome extension from Google

#45

Post by opendais »

latj wrote: post #41
tlrobinson wrote: post #17

Earlier quoted context omitted.

Does this also mean parts of memory containing, say, passwords could be send to Google?

This "end to end" encryption happens in the browser. Google is the browser. Google dont need your keys, they have the plain text.

I think he was thinking the "Save Password" feature.

Re: End-To-End – OpenPGP Chrome extension from Google

#46

Post by fragmede »

infogulch wrote: post #7
DoubleMalt wrote: post #2

This is really great news. But even better would it be if they'd incorporate it directly in gmail with a polished user interface.

No it wouldn't be better. You'd just have yet another LavaBit that claims ultimate security but has no teeth. The private keys must never touch the DOM, whether it comes from Google's servers or put there by an extension, otherwise it's vulnerable to someone hijacking/NSL-ing the gmail session. Therefore something must be installed on the local computer, whether that means a Chrome extension that has access to localS…

It would be better.

There's nothing that says Google can't bundle the extension with Chrome, and require Chrome or the extension on Firefox to use encrypted Gmail.

Re: End-To-End – OpenPGP Chrome extension from Google

#47

Post by agarden »

mixedbit wrote: post #40
opendais wrote: post #4

"Please note that enabling Chrome’s "Automatically send usage statistics and crash reports to Google" means that, in the event of a crash, parts of memory containing private key material might be sent to Google." I hope that has more than a FAQ warning when they release it to the Chrome Store. Otherwise....:/ It isn't perfect but it is probably the best in-browser option given the constraints available.

Maybe encryption/decryption could be performed in a separate, isolated process, which stack would never be sent? It seems like Chrome multiprocess architecture could allow for this.

Under "JavaScript crypto has very real risk of side-channel attacks": End-To-End’s crypto operations are performed in a different process from the web apps it interacts with.

Re: End-To-End – OpenPGP Chrome extension from Google

#48

Post by 1345 »

declan wrote: post #39
1345 wrote: post #34

Earlier quoted context omitted.

That sounds like NIH syndrome.

It's possible, but from my conversations with Google engineers in the past I'd guess (with no inside knowledge) that it was the result of a serious security evaluation of existing code. Especially post-Snowden, Google is taking this very seriously. See these posts, for instance, about TLS weaknesses and implementation of ChaCha20 and Poly1305 in OpenSSL -- a non-trivial task: http://googleonlinesecurity.blogspot.com/…

It's great to see them making the effort, but why not notify the OpenPGP.js with the outcome of a security evaluation? (I'm not aware of any other active javascript openpgp implementation, so I assume that's what you're referring to.) I've been following OpenPGP.js for a while and I've not seen anything from Google.

OpenPGP.js is not an amazing code base, I know this for sure. Perhaps a rewrite was the only way to salvage it.

I wonder why they didn't release the library independent from a browser extension. A brief look at the directory structure makes it seem that it wouldn't be too hard to decouple the OpenPGP implementation from the extension.

In any case, this is a big win for privacy. Reinventing the wheel or not.

Re: End-To-End – OpenPGP Chrome extension from Google

#49

Post by rhizome »

declan wrote: post #33
1345 wrote: post #26

Unless I'm mistaken, the author appears to be implementing OpenPGP in javascript. This has already been done by OpenPGP.js. That project is several years old, is active, and has been independently audited. Is this simply reinventing the wheel? OpenPGP.js can easily be used in an arbitrary browser extension. I have no affiliation with the OpenPGP.js project besides working on a small project for personal use.

Google's posting today addresses this point, I think: https://code.google.com/p/end-to-end/ "When we started work on End-To-End, there was no JavaScript crypto library that met our needs, so we built our own. During development we took into consideration all the criticisms and risks that we are aware of, and invested effort to mitigate these risks as much as possible... We hold ourselves to a higher standard; we star…

What's the implication there? At the end of the day it sounds like they simply didn't get involved in an open-source effort, in which case the NIH critique stands.

Re: End-To-End – OpenPGP Chrome extension from Google

#50

Post by unbehagen »

If it is a chrome extension and is installed via the Chrome Web Store, it can be updated silently in the background if I'm not mistaken. So in theory, wouldn't it be possible to serve Google with a NSL and force them to silently push a modified update to a targeted user that reveals the private key?
Post reply on HN