Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My weekend project - AES encryption for Gmail or anything else

encipher.it

Post reply on HN
Print view View original

31–40 of 71 posts

Re: My weekend project - AES encryption for Gmail or anything else

#31

Post by eran »

jgrahamc wrote: post #22

Your key derivation function is pretty weak. Looking at your code you are doing SHA256(password entered by user). You should take a look at using http://en.wikipedia.org/wiki/PBKDF2 for the key derivation. SHA256 is really fast and given that you are getting entropy from some user entered password (which is likely to be badly chosen) you want something _slow_ to derive the key. Hence PBKDF2 with lots of iterations.

Thank you point me out. Definitely, I need to implement PBKDF2 (and add salt to password). I planning this, but weekend is too short and finally I just put SHA256 for key derivation. But, until you describe, I do not recognize what the principal difference between hash and password based key derivation function, thanks.

Re: My weekend project - AES encryption for Gmail or anything else

#33

Post by moe »

Wouldn't it make more sense to revive FireGPG[1] and, while you're at it, port it to all other major browsers?

I am still disappointed that PGP in the browser never gained traction. Not only would it help with e-mail security, it could also be used for passwordless website logins, portable web identities, all that jazz[2].

One proper, user-friendly browser plugin could put an end to all those nasty kludges called OAuth, OpenID, LastPass, etc...

[1] http://getfiregpg.org/s/home

[2] http://en.wikipedia.org/wiki/Web_of_trust

Re: My weekend project - AES encryption for Gmail or anything else

#34

Post by antihero »

This is an awesome way of doing things. I'm going to be doing a slightly different implementation of this for my WIRE project on the advice of a bunch of people (more intense key differentiation, for a start), but it's good to know people are starting to do this :)

Re: My weekend project - AES encryption for Gmail or anything else

#35

Post by thwarted »

dedward wrote: post #19
eran wrote: post #10

Earlier quoted context omitted.

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Don't do your self the disservice of self-signed - you can get a free cert from startssl. The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....) Just hit up startssl and get a real certificate... it's that easy. No strings attached. (Repeati…

The "other" reason to avoid a self signed cert is that a self signed cert still leaves your users open to a MITM attack. If your goal is to avoid a MITM, a self signed cert gives you nothing but more configuration lines in your webserver config.

Re: My weekend project - AES encryption for Gmail or anything else

#37

Post by rorrr »

dedward wrote: post #19
eran wrote: post #10

Earlier quoted context omitted.

Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.

Don't do your self the disservice of self-signed - you can get a free cert from startssl. The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....) Just hit up startssl and get a real certificate... it's that easy. No strings attached. (Repeati…

It's only free for one year. It's a bait.

Re: My weekend project - AES encryption for Gmail or anything else

#38

Post by niels_olson »

Erwin wrote: post #30

Note that Gmail automatically saves your draft as you type it. So while this will offer some protection for the message while it's in transit from Google's server to your destination, your unencrypted message draft will still be sent to Google's servers (and given Google Apps' distributed architecture, I'm not sure you can determine where that unencrypted copy could end up or when it'd be erased). Perhaps a way aroun…

Firegpg used to support disabled drafts

Re: My weekend project - AES encryption for Gmail or anything else

#40

Post by IgorPartola »

moe wrote: post #33

Wouldn't it make more sense to revive FireGPG[1] and, while you're at it, port it to all other major browsers? I am still disappointed that PGP in the browser never gained traction. Not only would it help with e-mail security, it could also be used for passwordless website logins, portable web identities, all that jazz[2]. One proper, user-friendly browser plugin could put an end to all those nasty kludges called OAu…

Are there any webmail providers out there that support PGP? GMail never will since it needs the ability to read your email to show you ads.
Post reply on HN