Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End-To-End – OpenPGP Chrome extension from Google

code.google.com

Post reply on HN
Print view View original

121–130 of 173 posts

Re: End-To-End – OpenPGP Chrome extension from Google

#121

Post by letstryagain »

DSingularity wrote: post #120
letstryagain wrote: post #113

Earlier quoted context omitted.

Well if you're encrypting your email on your local PC and an attacker can conduct a side-channel attack then you're boned already. Your PC must be secure to begin with otherwise no crypto is going to save you. If an attacker can side-channel this encryption then he can probably just straight-up read your keystrokes or hard drive.

Why do you say this? I dont think all side channel attack surfaces require local access to the machine.

Can you give me an example that would be relevant here?

Re: End-To-End – OpenPGP Chrome extension from Google

#122

Post by maxtaco »

tokenizerrr wrote: post #62

Just tried this out and it works great! Had to build it using the instructions on the wiki, but nothing too painful. It doesn't just integrate with gmail, but more with all textarea's around the web. When you are typing in a textarea and press the extension icon next to the hamburger menu it will pop open a menu containing the text that you were typing on the site, and are given the options to encrypt/sign a message.…

Should be fixed now. The Google End-to-End library uses the 5-byte encoding scheme for signature subpacket lengths, which I hadn't seen used before and was buggy in KBPGP. Most signature subpackets are BTW, our library doesn't support the ECC extensions yet, so any encryptions/signatures generated with ECC keys will fail to decrypt/verify on keybase (and also on GPG v1.4).

Re: End-To-End – OpenPGP Chrome extension from Google

#123

Post by brianmwaters_hn »

letstryagain wrote: post #121
DSingularity wrote: post #120

Earlier quoted context omitted.

Why do you say this? I dont think all side channel attack surfaces require local access to the machine.

Can you give me an example that would be relevant here?

I think you're both right. There are side channel attacks against remote hosts (timing-based padding oracle attacks agains TLS come to mind). But for the case of PGP, which is mostly for encryption at-rest, attacks like this don't seem as relevant. I say seem as relevant, because crypto attacks can be surprising :)

Re: End-To-End – OpenPGP Chrome extension from Google

#124

Post by brianmwaters_hn »

makomk wrote: post #55

"Please note that EC support was added to GnuPG 2.1 beta in 2010, but it hasn’t been released as a stable version yet. To communicate with other people that don't use End-To-End, you will need to either generate a key in GnuPG and then import it, or build GnuPG 2.1 yourself." So basically, out the box this doesn't interoperate well with non-beta versions of GnuPG which are what everyone else is using for end-to-end e…

This is a huge problem that's akin to "replacing HTML/JS." It's a non backward-compatible change that make the plugin nearly 100% useless for current PGP users. Obviously folks can generate new EC keys, but they will be reluctant to abandon keys they've had for years that contain valuable third-party signatures. I think this will be a huge hindrance to adoption, and it would be imperative for the community to implement RSA, even if it's only for key import and interop, not generation.

Re: End-To-End – OpenPGP Chrome extension from Google

#125

Post by hrjet »

rakoo wrote: post #56
nilved wrote: post #10

Isn't this contrary to Google's goals as an advertising business? If people are using end-to-end encryption, they won't have cleartext emails to mine, &c. I need to wonder what the catch is, because there is definitely one: does Google own all the keys, or does Google secretly own all the keys?

> does Google own all the keys, or does Google secretly own all the keys The keys are generated by you, stored on your browser's localStorage, preferably encrypted (their words, not mine). Since it's open source and distributed by Google, I bet many eyeballs will look for bugs, much more than alternatives such as Mailvelope or WebPG. So, no, I don't think Google will ever have access to your private key through this…

> This will only impact geeks.

Geeks email non-geeks. If the non-geeks don't decrypt the messages it's going to be all greek to them.

So the more easy they make it for geeks, the more they are pushing non-geeks to adopt as well.

Re: End-To-End – OpenPGP Chrome extension from Google

#126

Post by cryptbe »

indutny wrote: post #115
cryptbe wrote: post #92

Earlier quoted context omitted.

Disclaimer: I contribute to the core crypto library in Google End-To-End. I was also a student of Prof. Boneh. I took his CS255, and became a TA for his infamous's Crypto I class on Coursera. So I guess at the end of the day it's still Boneh's teaching that has helped my colleagues and me create this library ;-). SJCL is a great library, but it didn't quite work for us because: * It isn't a Closure library. We want t…

Have you guys took a look at https://github.com/indutny/elliptic ?

Oh we haven't. Looks like it's a nice library. One question: it seems that you use the message directly, instead of its hash, in ECDSA? [1].

[1] https://github.com/indutny/elliptic/blob/master/lib/elliptic...

PS: were you the guy that won the CloudFlare's HeartBleed challenge? great work :-).

Re: End-To-End – OpenPGP Chrome extension from Google

#127

Post by cryptbe »

cryptbe wrote: post #92
dfc wrote: post #79

Earlier quoted context omitted.

I had a slightly different reaction to the "high standard" bit. I always thought Prof. Boneh was a high standard. Does anyone know if there were any obvious reasons to exclude SJCL?

Disclaimer: I contribute to the core crypto library in Google End-To-End. I was also a student of Prof. Boneh. I took his CS255, and became a TA for his infamous's Crypto I class on Coursera. So I guess at the end of the day it's still Boneh's teaching that has helped my colleagues and me create this library ;-). SJCL is a great library, but it didn't quite work for us because: * It isn't a Closure library. We want t…

> his infamous's Crypto I class

s/infamous/famous.

Re: End-To-End – OpenPGP Chrome extension from Google

#128

Post by sroerick »

Karunamon wrote: post #82
sroerick wrote: post #36

Earlier quoted context omitted.

Well, they could just serve privacy ads to people who were encrypting their communication.

Heh, that's actually a neat idea. The profile of people which regularly send/receive encrypted email is basically geeks right now. Key off of the "-----BEGIN PGP ENCRYPTED MESSAGE-----" bit.

Yeah. Honestly, I think that if you know that someone encrypts their messages, you probably know a lot more about them then most other data points reveal.

It would also get Google a lot of street cred for being a privacy centric business.

My only problem is, I just don't see how you can scale the Chromebook software stack to a privacy centric business. I can't imagine trying to secure PGP keys on a Chromebook. But I haven't used one since the early beta models, so others may have more informed opinions,.

Re: End-To-End – OpenPGP Chrome extension from Google

#129

Post by toomuchtodo »

sroerick wrote: post #36
nilved wrote: post #20

Earlier quoted context omitted.

"End-to-end" implies that Gmail won't be able to read your emails. That means that this software and Gmail, one of Google's largest products, are going to be competing. One of them needs to adapt or die: if this software isn't backdoored or vulnerable right now, it will either be shuttered, backdoored or made vulnerable in the future. (Certainly Gmail is of tangible, financial good to them: it's more likely for them…

Well, they could just serve privacy ads to people who were encrypting their communication.

Or offer to let me pay for Gmail in lieu of scanning my email. Seriously Google, take my money.

Re: End-To-End – OpenPGP Chrome extension from Google

#130

Post by x1798DE »

hrjet wrote: post #125
rakoo wrote: post #56

Earlier quoted context omitted.

> does Google own all the keys, or does Google secretly own all the keys The keys are generated by you, stored on your browser's localStorage, preferably encrypted (their words, not mine). Since it's open source and distributed by Google, I bet many eyeballs will look for bugs, much more than alternatives such as Mailvelope or WebPG. So, no, I don't think Google will ever have access to your private key through this…

> This will only impact geeks. Geeks email non-geeks. If the non-geeks don't decrypt the messages it's going to be all greek to them. So the more easy they make it for geeks, the more they are pushing non-geeks to adopt as well.

It's not really possible to send encrypted messages to people who aren't already using OpenPGP, since you need to get their public key, before you can encrypt the message. You could presumably encrypt it with some symmetric cipher ahead of time, then send them the encrypted junk and say, "Send me a PGP key and I'll send you the passphrase for the message!", but I dunno that anyone's going to do that.

That said, pretty much every message I send to someone who doesn't have a key on the keyservers includes, "Hey, send me your PGP key, I don't do plaintext."

Post reply on HN