Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

End-To-End – OpenPGP Chrome extension from Google

code.google.com

Post reply on HN
Print view View original

21–30 of 173 posts

Re: End-To-End – OpenPGP Chrome extension from Google

#21

Post by tlrobinson »

orik wrote: post #14
dfc wrote: post #11

The FAQ states: > Only the body of the message. Please note that, as with all OpenPGP > messages, the email subject line and list of recipients remain > unencrypted. Hopefully attachments are considered part of the body?

Why would attachments be considered part of the body? Encrypt them before uploading them, and send the decrypting key in the body.

Because as far as the email protocol is concerned attachments are part of the body, just wrapped in a multipart MIME message along with text body.

But Gmail itself may handle attachments differently.

Re: End-To-End – OpenPGP Chrome extension from Google

#22

Post by DoubleMalt »

infogulch wrote: post #7
DoubleMalt wrote: post #2

This is really great news. But even better would it be if they'd incorporate it directly in gmail with a polished user interface.

No it wouldn't be better. You'd just have yet another LavaBit that claims ultimate security but has no teeth. The private keys must never touch the DOM, whether it comes from Google's servers or put there by an extension, otherwise it's vulnerable to someone hijacking/NSL-ing the gmail session. Therefore something must be installed on the local computer, whether that means a Chrome extension that has access to localS…

Well the threat model would rather be that Google is forced to serve a version of JavaScript to you that leaks your private key. Which is a concern and a reason why you should rather use a self hosted email client like Mailpile.

If you are concerned about someone hijacking the gmail session you have lost anyway, as the decrypted (or not-yet-encrypted) text surely has to hit the dom at some point.

Re: End-To-End – OpenPGP Chrome extension from Google

#23

Post by opendais »

bildeman wrote: post #9
nobodysfool wrote: post #6

Earlier quoted context omitted.

simple, just turn that feature off.

If you wanted this to be available for the general public then it could be slightly more troublesome.

Yes, but as long as it is clearly mentioned by the Install button in big, bold letters it isn't a problem.

Re: End-To-End – OpenPGP Chrome extension from Google

#24

Post by opendais »

tlrobinson wrote: post #17
opendais wrote: post #4

"Please note that enabling Chrome’s "Automatically send usage statistics and crash reports to Google" means that, in the event of a crash, parts of memory containing private key material might be sent to Google." I hope that has more than a FAQ warning when they release it to the Chrome Store. Otherwise....:/ It isn't perfect but it is probably the best in-browser option given the constraints available.

Does this also mean parts of memory containing, say, passwords could be send to Google?

I'd hope not. My guess is the extensions data in memory are included with the crash reports and it doesn't distinguish between extensions.

Re: End-To-End – OpenPGP Chrome extension from Google

#25

Post by mrb »

DoubleMalt wrote: post #2

This is really great news. But even better would it be if they'd incorporate it directly in gmail with a polished user interface.

End-to-End is better outside Gmail. Because it is an extension, you can encrypt/decrypt any message in any webpage such as: web forums, other web mail providers (yes even Yahoo Mail, Outlook.com, etc), or your custom internal SquirrelMail or Outlook Web Access instance, etc.

Its open source can be reviewed by third parties, it can be built and installed locally, with no dependency or trust placed in Google's online services. Heck, it can even be (in theory - I never tried) installed on Chromium if you are paranoid and don't trust the few non-open source parts of Chrome.

Re: End-To-End – OpenPGP Chrome extension from Google

#26

Post by 1345 »

Unless I'm mistaken, the author appears to be implementing OpenPGP in javascript. This has already been done by OpenPGP.js. That project is several years old, is active, and has been independently audited.

Is this simply reinventing the wheel? OpenPGP.js can easily be used in an arbitrary browser extension.

I have no affiliation with the OpenPGP.js project besides working on a small project for personal use.

Re: End-To-End – OpenPGP Chrome extension from Google

#27

Post by infogulch »

DoubleMalt wrote: post #22
infogulch wrote: post #7

Earlier quoted context omitted.

No it wouldn't be better. You'd just have yet another LavaBit that claims ultimate security but has no teeth. The private keys must never touch the DOM, whether it comes from Google's servers or put there by an extension, otherwise it's vulnerable to someone hijacking/NSL-ing the gmail session. Therefore something must be installed on the local computer, whether that means a Chrome extension that has access to localS…

Well the threat model would rather be that Google is forced to serve a version of JavaScript to you that leaks your private key. Which is a concern and a reason why you should rather use a self hosted email client like Mailpile. If you are concerned about someone hijacking the gmail session you have lost anyway, as the decrypted (or not-yet-encrypted) text surely has to hit the dom at some point.

In this project, even if Google is forced to serve a compromised version of Gmail's javascript they still can't get your key, since it's stored in the browser's localStorage and is private to the extension, where all the crypto happens. All gmail gets is the end result.

So the threat model for this project is autoupdates. Extension autoupdate, chrome autoupdate and OS autoupdate could all compromise this, but that's still worlds better than just sending some different obfuscated javascript in a browser session.

Re: End-To-End – OpenPGP Chrome extension from Google

#28

Post by ams6110 »

nilved wrote: post #10

Isn't this contrary to Google's goals as an advertising business? If people are using end-to-end encryption, they won't have cleartext emails to mine, &c. I need to wonder what the catch is, because there is definitely one: does Google own all the keys, or does Google secretly own all the keys?

The headers, subject line, recipients are not encrypted. There's probably enough info in the subject line and recipients and corpus of other recent subject lines sent among those recipients to still do a halfway decent job at targeting ads.

Re: End-To-End – OpenPGP Chrome extension from Google

#29

Post by lambada »

DoubleMalt wrote: post #22
infogulch wrote: post #7

Earlier quoted context omitted.

No it wouldn't be better. You'd just have yet another LavaBit that claims ultimate security but has no teeth. The private keys must never touch the DOM, whether it comes from Google's servers or put there by an extension, otherwise it's vulnerable to someone hijacking/NSL-ing the gmail session. Therefore something must be installed on the local computer, whether that means a Chrome extension that has access to localS…

Well the threat model would rather be that Google is forced to serve a version of JavaScript to you that leaks your private key. Which is a concern and a reason why you should rather use a self hosted email client like Mailpile. If you are concerned about someone hijacking the gmail session you have lost anyway, as the decrypted (or not-yet-encrypted) text surely has to hit the dom at some point.

Encypt it offline, copy paste the encrypted text+signature into the GMail compose window. Unencrypted never hits the DOM (unless the recipient has an extension that decrypts in the DOM).
Post reply on HN