Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End-To-End – OpenPGP Chrome extension from Google

code.google.com

Post reply on HN
Print view View original

111–120 of 173 posts

Re: End-To-End – OpenPGP Chrome extension from Google

#111

Post by declan »

jacquesm wrote: post #105
declan wrote: post #39

Earlier quoted context omitted.

It's possible, but from my conversations with Google engineers in the past I'd guess (with no inside knowledge) that it was the result of a serious security evaluation of existing code. Especially post-Snowden, Google is taking this very seriously. See these posts, for instance, about TLS weaknesses and implementation of ChaCha20 and Poly1305 in OpenSSL -- a non-trivial task: http://googleonlinesecurity.blogspot.com/…

> Also, the account you're posting from was created 22 minutes ago and has done nothing but post criticisms of today's announcement. Coincidence? :) Declan, nothing but respect for all your writings but he's got to make an account one day and if he's critical but otherwise polite and seems to be willing to concede the point why attack like that? It might be an account created specifically to protect a reputation. As…

You're right. In retrospect I was a little too suspicious, and 's subsequent comment was perfectly fair.

Re: End-To-End – OpenPGP Chrome extension from Google

#112

Post by 6cxs2hd6 »

res0nat0r wrote: post #31
nilved wrote: post #20

Earlier quoted context omitted.

"End-to-end" implies that Gmail won't be able to read your emails. That means that this software and Gmail, one of Google's largest products, are going to be competing. One of them needs to adapt or die: if this software isn't backdoored or vulnerable right now, it will either be shuttered, backdoored or made vulnerable in the future. (Certainly Gmail is of tangible, financial good to them: it's more likely for them…

Sure using this will just send a bunch of gibberish to Gmail in the body such that Gmail won't be able to auto-scan for ad keywords to send to you. But this probably will be used by .000001% of Gmail users, so I doubt they are worried about this affecting their business in any meaningful way.

And, even among those people who do use it, a big percentage of their email will remain unencrypted. Transactional email like flight or hotel booking confirmations sent from the airline or hotel. I have to think that's the valuable stuff to Google in terms of selling ads, not the topics you would choose to encrypt.

So the downside to them is not that big. And it's offset by the upside of user trust and confidence being maintained, or at least eroding less.

Re: End-To-End – OpenPGP Chrome extension from Google

#113

Post by letstryagain »

zx2c4 wrote: post #89

Notable aspects -- Looks like they're taking it seriously: "Are End-To-End security bugs eligible for Google’s Vulnerability Rewards Program? Yes, we have specifically expanded the scope of our Vulnerability Rewards Program to include End-To-End. This means that reports of exploitable security bugs within End-To-End are eligible for a reward." Should be an interesting trove of JS tricks: "JavaScript crypto has very r…

Well if you're encrypting your email on your local PC and an attacker can conduct a side-channel attack then you're boned already. Your PC must be secure to begin with otherwise no crypto is going to save you. If an attacker can side-channel this encryption then he can probably just straight-up read your keystrokes or hard drive.

Re: End-To-End – OpenPGP Chrome extension from Google

#114

Post by [deleted] »

mindstab wrote: post #76

Eleanor Saitta (@Dymaxion) had a few things to say about this on Twitter: On the one hand, I'm happy Google is trying to make GPG usable within GMail: https://code.google.com/p/end-to-end/ . On the other hand, this leaves many ?s It sounds like all you get from "end-to-end", other than a name that's going to cause horrible confusion, is a bare mininum of GPG functions. No TOFU, no pushing users to encrypt by default,…

[deleted]

Re: End-To-End – OpenPGP Chrome extension from Google

#115

Post by indutny »

cryptbe wrote: post #92
dfc wrote: post #79

Earlier quoted context omitted.

I had a slightly different reaction to the "high standard" bit. I always thought Prof. Boneh was a high standard. Does anyone know if there were any obvious reasons to exclude SJCL?

Disclaimer: I contribute to the core crypto library in Google End-To-End. I was also a student of Prof. Boneh. I took his CS255, and became a TA for his infamous's Crypto I class on Coursera. So I guess at the end of the day it's still Boneh's teaching that has helped my colleagues and me create this library ;-). SJCL is a great library, but it didn't quite work for us because: * It isn't a Closure library. We want t…

Have you guys took a look at https://github.com/indutny/elliptic ?

Re: End-To-End – OpenPGP Chrome extension from Google

#116

Post by john2x »

tlrobinson wrote: post #21
orik wrote: post #14

Earlier quoted context omitted.

Why would attachments be considered part of the body? Encrypt them before uploading them, and send the decrypting key in the body.

Because as far as the email protocol is concerned attachments are part of the body, just wrapped in a multipart MIME message along with text body. But Gmail itself may handle attachments differently.

> But Gmail itself may handle attachments differently.

AFAIK, Gmail handles attachments the same.

Re: End-To-End – OpenPGP Chrome extension from Google

#117

Post by declan »

hifier wrote: post #101
declan wrote: post #32

Earlier quoted context omitted.

is correct. I wrote about this in 2007: http://news.cnet.com/Will-security-firms-detect-police-spywa... "In theory, government agencies could even seek a court order requiring security companies to deliver spyware to their customers as part of an auto-update feature. Most modern security companies, including operating system makers such as Microsoft and Apple, offer regular patches and bug fixes. Although it would be…

I agree that such a thread model makes things difficult, however I'd like to believe that it can be solved for. Regardless, there is value in hiding your communications from mass, non-targeted surveillance.

If you're able to completely "solve for" the threat model of NSA/FBI/GCHQ/CIA/etc. having a serious and persistent interest in you, and knowing where you sleep at night, my hat's off to you. Few people are that confident.

Re: End-To-End – OpenPGP Chrome extension from Google

#118

Post by tlrobinson »

john2x wrote: post #116
tlrobinson wrote: post #21

Earlier quoted context omitted.

Because as far as the email protocol is concerned attachments are part of the body, just wrapped in a multipart MIME message along with text body. But Gmail itself may handle attachments differently.

> But Gmail itself may handle attachments differently. AFAIK, Gmail handles attachments the same.

When it sends them, yes, but this is more what I was referring to: https://news.ycombinator.com/item?id=7842868

Re: End-To-End – OpenPGP Chrome extension from Google

#120

Post by DSingularity »

letstryagain wrote: post #113
zx2c4 wrote: post #89

Notable aspects -- Looks like they're taking it seriously: "Are End-To-End security bugs eligible for Google’s Vulnerability Rewards Program? Yes, we have specifically expanded the scope of our Vulnerability Rewards Program to include End-To-End. This means that reports of exploitable security bugs within End-To-End are eligible for a reward." Should be an interesting trove of JS tricks: "JavaScript crypto has very r…

Well if you're encrypting your email on your local PC and an attacker can conduct a side-channel attack then you're boned already. Your PC must be secure to begin with otherwise no crypto is going to save you. If an attacker can side-channel this encryption then he can probably just straight-up read your keystrokes or hard drive.

Why do you say this? I dont think all side channel attack surfaces require local access to the machine.
Post reply on HN