Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My weekend project - AES encryption for Gmail or anything else

encipher.it

Post reply on HN
Print view View original

61–70 of 71 posts

Re: My weekend project - AES encryption for Gmail or anything else

#61

Post by kgo »

eli wrote: post #43
IgorPartola wrote: post #40

Earlier quoted context omitted.

Are there any webmail providers out there that support PGP? GMail never will since it needs the ability to read your email to show you ads.

HushMail and Countermail do. I think it never really caught on because if you really care about end-to-end security, you wouldn't be using a webmail provider.

HushMail has a java based browser that's supposed to be all client side, but last time I tried hush, they generated keys that were incompatible with GPG2.

But yeah, like you said, if you're only checking emails on machines that are secure and in your control, you might as well just install Tbird/Enigmail. And if you're at the library or a computer lab, you can't trust the client to be secure.

Re: My weekend project - AES encryption for Gmail or anything else

#63

Post by antihero »

antihero wrote: post #34

This is an awesome way of doing things. I'm going to be doing a slightly different implementation of this for my WIRE project on the advice of a bunch of people (more intense key differentiation, for a start), but it's good to know people are starting to do this :)

Edit: Just finished implementing this using the Stanford library - check it out (non-SSL test site) http://wire.0xf.nl

Re: My weekend project - AES encryption for Gmail or anything else

#66

Post by patrickaljord »

IgorPartola wrote: post #40
moe wrote: post #33

Wouldn't it make more sense to revive FireGPG[1] and, while you're at it, port it to all other major browsers? I am still disappointed that PGP in the browser never gained traction. Not only would it help with e-mail security, it could also be used for passwordless website logins, portable web identities, all that jazz[2]. One proper, user-friendly browser plugin could put an end to all those nasty kludges called OAu…

Are there any webmail providers out there that support PGP? GMail never will since it needs the ability to read your email to show you ads.

> GMail never will since it needs the ability to read your email to show you ads.

It could still read your email after decryption and show ads based on that, it would be easy to do with JS. Search would be broken though unless they encrypt each word separately, but that would make your inbox size grow quickly, still doable.

Re: My weekend project - AES encryption for Gmail or anything else

#68

Post by nopassrecover »

I'm pretty amateur on cryptography, and this is cool and everything for basic security, but for those more in the know does the fact that the algorithm knows a password is "wrong" weaken the cryptography (I realise it's a cool feature of this app, I'm talking generally)? Presumably you would have to test each decrypted result for language words etc. otherwise to know if you had decrypted it correctly.

Re: My weekend project - AES encryption for Gmail or anything else

#69

Post by yan »

nopassrecover wrote: post #68

I'm pretty amateur on cryptography, and this is cool and everything for basic security, but for those more in the know does the fact that the algorithm knows a password is "wrong" weaken the cryptography (I realise it's a cool feature of this app, I'm talking generally)? Presumably you would have to test each decrypted result for language words etc. otherwise to know if you had decrypted it correctly.

Or prepend a known header to the plaintext you're encrypting..

Re: My weekend project - AES encryption for Gmail or anything else

#70

Post by eran »

jgrahamc wrote: post #22

Your key derivation function is pretty weak. Looking at your code you are doing SHA256(password entered by user). You should take a look at using http://en.wikipedia.org/wiki/PBKDF2 for the key derivation. SHA256 is really fast and given that you are getting entropy from some user entered password (which is likely to be badly chosen) you want something _slow_ to derive the key. Hence PBKDF2 with lots of iterations.

Today I've updated key derivation to use pbkdf2 (1000 cycles, google chrome execution time around 2 sec)
Post reply on HN