Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My weekend project - AES encryption for Gmail or anything else

encipher.it

Post reply on HN
Print view View original

11–20 of 71 posts

Re: My weekend project - AES encryption for Gmail or anything else

#11

Post by tptacek »

pixdamix wrote: post #7

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

He'd also need to HTTPS all the scripts that script requires, and devise some way to ensure that the script was never called from a page that itself included any HTML or JS over a non-HTTPS connection, because any of those document loads could also MITM the script. Isn't Javascript crypto fun!

Re: My weekend project - AES encryption for Gmail or anything else

#12

Post by tptacek »

eran wrote: post #10
pixdamix wrote: post #7

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Even if you could somehow minify all of AES into a bookmarklet, you'd still lose any time any page this ran from requested HTML or JS from a non-HTTPS link, since any of those requests could poison the runtime.

Re: My weekend project - AES encryption for Gmail or anything else

#13

Post by tptacek »

eran wrote: post #3
zitterbewegung wrote: post #2

Thats pretty neat since you have of the encryption done client side. Which mode of AES do you use?

I use counter mode with 256 bit key Key is generated as sha256 hash of the user password

That's also not a secure way of generating an AES key; those crypto keys can be cracked quickly. The problem you're trying to solve is the entire reason for PBKDF2.

You should also use SJCL's AES.

Re: My weekend project - AES encryption for Gmail or anything else

#15

Post by evanw »

megamark16 wrote: post #6

This is great, I was just thinking the other day that it should be possible to encrypt gmail messages. Now you should make it possible to encrypt GChat messages automatically when I hit Send, and then decrypt them when they are received, that way they are encrypted end to end, instead of just between my browser and the server :-)

If you use Pidgin, you can do just that with the Pidgin-Encryption plugin. Both parties need the plugin installed, though.

http://pidgin-encrypt.sourceforge.net/

Re: My weekend project - AES encryption for Gmail or anything else

#16

Post by agentultra »

While I won't point out the technical reasons why encryption is hard, I will say that I think this project is cool.

I think encryption is something more people might use if it were accessible.

But it's hard enough as it is without making it so easy that Joe Sixpack could use it -- especially since implementations as we know it require Joe Sixpack to understand what he's doing or else the encryption fails.

However, tools like this at least give us prototypes for ideas that could one-day bridge the gap.

Good job, dude. Hope you stick with it and find a way to make it better.

Re: My weekend project - AES encryption for Gmail or anything else

#17

Post by pixdamix »

eran wrote: post #10
pixdamix wrote: post #7

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

You would be able to get past 2048bytes using mozilla or chromium

See there: https://www.squarefree.com/bookmarklets/limits.html

I just tested a 1Mb bookmarlet on chromium and it works.

Re: My weekend project - AES encryption for Gmail or anything else

#18

Post by Shenglong »

agentultra wrote: post #16

While I won't point out the technical reasons why encryption is hard, I will say that I think this project is cool. I think encryption is something more people might use if it were accessible. But it's hard enough as it is without making it so easy that Joe Sixpack could use it -- especially since implementations as we know it require Joe Sixpack to understand what he's doing or else the encryption fails. However, to…

I found your "Joe Sixpack" reference extremely comical.

Re: My weekend project - AES encryption for Gmail or anything else

#19

Post by dedward »

eran wrote: post #10
pixdamix wrote: post #7

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Don't do your self the disservice of self-signed - you can get a free cert from startssl.

The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....)

Just hit up startssl and get a real certificate... it's that easy. No strings attached.

(Repeating this because I ignored it for about a year until actually checking it out and realizing I'd been an idiot)

ALSO

Given the single utility of this - just inline the scripts you need and avoid the request overhead. You can probably strip out all the functions you don't need to minimize the load time. You could offer a minimized version as well....

ALSO

Very cool! Thanks!

Re: My weekend project - AES encryption for Gmail or anything else

#20

Post by Ixiaus »

I feel like this would be better as a browser extension instead of a bookmarklet... I get a bit queasy about the potential for MITM with this implementation. An extension that could bring GPG to the mix, would be VERY awesome (if that doesn't exist, I actually haven't tried searching for that...).

Cool project though :)

Post reply on HN