Kudos to them for doing it even though it goes directly against their business model (mining your information). I guess they're betting that the vast majority of people won't use this.
End-To-End – OpenPGP Chrome extension from Google
151–160 of 173 posts
Re: End-To-End – OpenPGP Chrome extension from Google
#152Earlier quoted context omitted.
But as I'm typing, Gmail is saving my draft automatically to Google servers. Normally, at least. This means Google would have a copy of my email as it existed before I encrypted it. In your testing, do you see any evidence that this extension prevents Gmail's automatic draft saving?
In the FAQ they mention "End-To-End doesn’t trust any website's DOM or context with unencrypted data. We have tried to ensure that the interaction between the extension and websites is minimal and does not reveal secrets to the website." I'm curious about this too. Does that mean they somehow insert a textbox that the host page can't see? I didn't realize extensions could do that. Edit: ah, this appears to be where i…
It would be nice if that got added to PwdHash[1] extension[2]. PwdHash chrome extension currently seems to just try to capture all keyboard events while the master password is entered in a site's password box. Also, it seems to me that it runs in the site's context.
[1] https://www.pwdhash.com/ [2] https://code.google.com/p/chrome-pwdhash/
Re: End-To-End – OpenPGP Chrome extension from Google
#153Earlier quoted context omitted.
Have you guys took a look at https://github.com/indutny/elliptic ?
Oh we haven't. Looks like it's a nice library. One question: it seems that you use the message directly, instead of its hash, in ECDSA? [1]. [1] https://github.com/indutny/elliptic/blob/master/lib/elliptic... PS: were you the guy that won the CloudFlare's HeartBleed challenge? great work :-).
I do expect users to hash the message before passing it to ECDSA, this way you could use any hashing library with it. Though, elliptic.js does actually depends on hash.js to seed it's PRNG.
Thank you!
Re: End-To-End – OpenPGP Chrome extension from Google
#154Earlier quoted context omitted.
How about BEAST or CRIME?
BEAST is a design bug, insecure use of CBC mode. CRIME is a side channel attack, but the side channel that leaks information (compressed cleartext size) is not related to the language used, but again to the design of the algorithm. The basic idea is that implementation-related side-channel attacks, such as timing and power draw, are very hard to exploit remotely. I guess you could write a JavaScript implementation of…
Maybe power draw is hard to exploit remotely, but Remote Timing Attacks are Practical (Brumley & Boneh, Stanford, 2003): http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
Re: End-To-End – OpenPGP Chrome extension from Google
#155Can anyone tell if this addon has been built in a suitably abstract enough manner such that the core can be used to build similar extensions for other browsers? I.e, would it be possible to take this code and wrap it in a Firefox extension?
The core library is in use in many Google products and runs across all browsers.
Re: End-To-End – OpenPGP Chrome extension from Google
#156Nice. While they're at it, maybe they'll revive gpgAuth, so maybe we'll eventually have a sane and useable PKI-based auth on the web?
Oh, and maybe having PGP's WOT for use by the websites would be nice too. Could provide distributed "likes" by PGP-signing, without any central authorities.
Re: End-To-End – OpenPGP Chrome extension from Google
#157I worked at a company who has a very similar product,
Re: End-To-End – OpenPGP Chrome extension from Google
#158Earlier quoted context omitted.
Also, other browser extensions may be able to access what is going on in the browser. So Google and (insert list of other parties.)
Other software on your computer might as well. Or people walking by in the hallway. So Google and (insert everyone in the world).
[deleted]
Re: End-To-End – OpenPGP Chrome extension from Google
#159Earlier quoted context omitted.
Also, other browser extensions may be able to access what is going on in the browser. So Google and (insert list of other parties.)
Other software on your computer might as well. Or people walking by in the hallway. So Google and (insert everyone in the world).
In the end, it is Google Chrome's fault.
Re: End-To-End – OpenPGP Chrome extension from Google
#160Earlier quoted context omitted.
Well, they could just serve privacy ads to people who were encrypting their communication.
Or offer to let me pay for Gmail in lieu of scanning my email. Seriously Google, take my money.
You may want to find another email provider with a different business model.