Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End-To-End – OpenPGP Chrome extension from Google

code.google.com

Post reply on HN
Print view View original

81–90 of 173 posts

Re: End-To-End – OpenPGP Chrome extension from Google

#81

Post by cryptbe »

dotBen wrote: post #71

So End-To-End utilizes Elliptic Curve-based keys Could someone better across current cryptographic trends than I comment on that choice? We know the NSA has found weaknesses in certain implementations of elliptic-curve based cryptography in the past, and I was under the impression there was a preference in the community to move away from them in general given the unknown extent of the integrity concerns.

> We know the NSA has found weaknesses in certain implementations of elliptic-curve based cryptography in the past

No, we don't.

Even djb wants people to use ECC. Note that End-To-End supports not only NIST's curves but also djb's.

Re: End-To-End – OpenPGP Chrome extension from Google

#82

Post by Karunamon »

sroerick wrote: post #36
nilved wrote: post #20

Earlier quoted context omitted.

"End-to-end" implies that Gmail won't be able to read your emails. That means that this software and Gmail, one of Google's largest products, are going to be competing. One of them needs to adapt or die: if this software isn't backdoored or vulnerable right now, it will either be shuttered, backdoored or made vulnerable in the future. (Certainly Gmail is of tangible, financial good to them: it's more likely for them…

Well, they could just serve privacy ads to people who were encrypting their communication.

Heh, that's actually a neat idea. The profile of people which regularly send/receive encrypted email is basically geeks right now. Key off of the "-----BEGIN PGP ENCRYPTED MESSAGE-----" bit.

Re: End-To-End – OpenPGP Chrome extension from Google

#83

Post by base698 »

tokenizerrr wrote: post #62

Just tried this out and it works great! Had to build it using the instructions on the wiki, but nothing too painful. It doesn't just integrate with gmail, but more with all textarea's around the web. When you are typing in a textarea and press the extension icon next to the hamburger menu it will pop open a menu containing the text that you were typing on the site, and are given the options to encrypt/sign a message.…

I just get this after clicking the extension icon: http://imgur.com/oBoNgI1

Re: End-To-End – OpenPGP Chrome extension from Google

#84

Post by tokenizerrr »

base698 wrote: post #83
tokenizerrr wrote: post #62

Just tried this out and it works great! Had to build it using the instructions on the wiki, but nothing too painful. It doesn't just integrate with gmail, but more with all textarea's around the web. When you are typing in a textarea and press the extension icon next to the hamburger menu it will pop open a menu containing the text that you were typing on the site, and are given the options to encrypt/sign a message.…

I just get this after clicking the extension icon: http://imgur.com/oBoNgI1

Odd. Have you followed the steps on https://code.google.com/p/end-to-end/wiki/BuildInstructions?... then loaded the e2e_dev\end-to-end\javascript\crypto\e2e\extension directory as an unpacked extension? Maybe you don't have java so csscompile failed?

Re: End-To-End – OpenPGP Chrome extension from Google

#85

Post by base698 »

tokenizerrr wrote: post #84
base698 wrote: post #83

Earlier quoted context omitted.

I just get this after clicking the extension icon: http://imgur.com/oBoNgI1

Odd. Have you followed the steps on https://code.google.com/p/end-to-end/wiki/BuildInstructions?... then loaded the e2e_dev\end-to-end\javascript\crypto\e2e\extension directory as an unpacked extension? Maybe you don't have java so csscompile failed?

Seems to work great after a full rm -rf e2e-dev and start over.

There was an issue with the html copy step because of the -t option, fixed that and submitted an issue.

Re: End-To-End – OpenPGP Chrome extension from Google

#86

Post by dragonwriter »

marcosdumay wrote: post #69
dragonwriter wrote: post #38

Earlier quoted context omitted.

> Why would attachments be considered part of the body? Because if you look at the low-level structure of email, "attachments" are just parts of a body that is in multipart/mixed MIME type.

If you look that low, the body isn't actually encrypted, just the parts of it that contain your data. Answering the GP, that varies from one implementation to another. Most clients encrypt attachments, but it looks like this one extension only encrypts the textarea contents.

Right, I was responding to the "why would attachments be considered part of the body?", not describing whether or not the Google implementation actually did treat them that way.

Re: End-To-End – OpenPGP Chrome extension from Google

#87

Post by 1345 »

dfc wrote: post #79
panarky wrote: post #65

Regarding JavaScript crypto: We hold ourselves to a higher standard; we started from scratch and created a testable, modern, cryptographic library. That is awesome. So's this: Chrome’s design means that extensions should be safe against other extensions. And this: End-To-End uses Content Security Policy as well as inherently safe APIs in frameworks (strict Closure Templates). End-To-End doesn’t trust any website's DO…

I had a slightly different reaction to the "high standard" bit. I always thought Prof. Boneh was a high standard. Does anyone know if there were any obvious reasons to exclude SJCL?

SJCL does not support all of the primitives needed for OpenPGP.

Re: End-To-End – OpenPGP Chrome extension from Google

#88

Post by dfc »

1345 wrote: post #87
dfc wrote: post #79

Earlier quoted context omitted.

I had a slightly different reaction to the "high standard" bit. I always thought Prof. Boneh was a high standard. Does anyone know if there were any obvious reasons to exclude SJCL?

SJCL does not support all of the primitives needed for OpenPGP.

I guess I should have been more clear. Why not add the primitives to SJCL and leverage an existing code base--a code base authored by someone who is considered to set a very high standard in crypto--instead of reinventing everything? Setting a higher standard than Prof. Boneh seems like a tough thing to do. Why not stand on Boneh et. al's shoulders?

Re: End-To-End – OpenPGP Chrome extension from Google

#89

Post by zx2c4 »

Notable aspects --

Looks like they're taking it seriously:

"Are End-To-End security bugs eligible for Google’s Vulnerability Rewards Program?

Yes, we have specifically expanded the scope of our Vulnerability Rewards Program to include End-To-End. This means that reports of exploitable security bugs within End-To-End are eligible for a reward."

Should be an interesting trove of JS tricks:

"JavaScript crypto has very real risk of side-channel attacks

Since JavaScript code doesn't control the instructions being executed by the CPU — the JavaScript engine can perform optimizations out of the code’s control — it creates the risk of security-sensitive information leaks. End-To-End requires user interaction for private operations in normal use, mitigating this risk. Non-user-interaction actions are rate-limited and done in fixed time. End-To-End’s crypto operations are performed in a different process from the web apps it interacts with. The End-To-End library is as timing-aware it can be and we’ve invested effort to mitigate any exploitable risk."

Re: End-To-End – OpenPGP Chrome extension from Google

#90

Post by cbhl »

makomk wrote: post #60
zeroxfe wrote: post #59

Earlier quoted context omitted.

"We’re releasing this code to enable community review; it is not yet ready for general use."

I don't think they're planning on changing that, according to later FAQ entries generating non-EC private keys is just too slow and it's the use of EC keys that causes the problem.

s/causes/solves/
Post reply on HN