Very cool. Something like that for GPG encrypted emails would be great.
My weekend project - AES encryption for Gmail or anything else
51–60 of 71 posts
Re: My weekend project - AES encryption for Gmail or anything else
#52Earlier quoted context omitted.
HushMail and Countermail do. I think it never really caught on because if you really care about end-to-end security, you wouldn't be using a webmail provider.
If you had a working (and secure) crypto on the client side you could use a webmail provider and still be secure. I can imagine an extension for Chrome or Firefox that will not be updated without my knowledge and has been peer reviewed like gnupg.
As long as the extension does not then place the cleartext back into the DOM. I would also want support on my Android phone too. So I guess basically, it's never happening.
Re: My weekend project - AES encryption for Gmail or anything else
#53Earlier quoted context omitted.
I assume you know that the reason you add a salt is to prevent rainbow table attacks. Without a salt, if someone obtains the hash then they need to just run it through a single rainbow table and with very high probability, obtain the password. A SHA{1,2,3,128,256,512} hash is very VERY VERY fast. So fast, in fact, that an attacker who has the hash could easily run through all 8 character passwords given a few GPU mac…
How does bcrypt stack up against PBKDF2?
They're both good. I'd pick bcrypt, but if you're using PBKDF2, it's probably because it's simpler to implement.
Re: My weekend project - AES encryption for Gmail or anything else
#54Earlier quoted context omitted.
Would using SPDY help?
Not in and of itself. Google runs SPDY over SSL, just as they also run HTTP over SSL (HTTPS). It's the SSL that makes it secure. Once you're running one protocol over SSL, you might as well run all of them over SSL. The basic problem here is that JS is too dynamic to ensure this type of security. Any script running on the page can rebind any value, monitor or trigger any event, or a number of other things. Without SS…
Caja / Secure EcmaScript should fix the JS-too-dynamic problem. I haven't tried it out yet.
Re: My weekend project - AES encryption for Gmail or anything else
#55Hmm, testing it out it constantly confuses weather it should be encrypting or decrypting. I've tried to enter a message and had it request a decryption password.
That combined with the poor crypto practices makes it rather unusable, but it's a fantastic concept! Just needs a bit of work.
Re: My weekend project - AES encryption for Gmail or anything else
#56Earlier quoted context omitted.
HushMail and Countermail do. I think it never really caught on because if you really care about end-to-end security, you wouldn't be using a webmail provider.
If you had a working (and secure) crypto on the client side you could use a webmail provider and still be secure. I can imagine an extension for Chrome or Firefox that will not be updated without my knowledge and has been peer reviewed like gnupg.
If I can't safely check my mail from random computers anyway, I'd just as soon remove the browser from the equation and use a GPG-compatible mail client.
Re: My weekend project - AES encryption for Gmail or anything else
#57Earlier quoted context omitted.
Not in and of itself. Google runs SPDY over SSL, just as they also run HTTP over SSL (HTTPS). It's the SSL that makes it secure. Once you're running one protocol over SSL, you might as well run all of them over SSL. The basic problem here is that JS is too dynamic to ensure this type of security. Any script running on the page can rebind any value, monitor or trigger any event, or a number of other things. Without SS…
Caja / Secure EcmaScript should fix the JS-too-dynamic problem. I haven't tried it out yet.
It doesn't help in this case, since an attacker can just insert plain old JS. Caja (and similar things) only help for code you can actually put through the Cajoler.
It's still a good, if imperfect, solution for other use-cases.
Re: My weekend project - AES encryption for Gmail or anything else
#58javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://encipher.it/javascripts/inject.js';})(); You should consider moving to https. After all, what's the point in providing this kind of script if anyone can MITM it ? Besides that, this is pretty cool. Could you provide a standalone bookmarlet which doesn't need to download any scripts ?
MITM issue fixed, all resources are loading over SSL
Re: My weekend project - AES encryption for Gmail or anything else
#59Very nice. I've been thinking of something like this for my project as well. The problem I face is how do you securely exchange the key.
Re: My weekend project - AES encryption for Gmail or anything else
#60Who are you protecting the message from when you do this? Gmail? But they can just send the cleartext to the server before you click "encrypt it", and in fact they do (drafts).
Don't type stuff into a program you didn't write if you don't want the author to see it.