Roundcube Webmail 1.2.0 released with PGP support
roundcube.net
Roundcube Webmail 1.2.0 released with PGP support
1–10 of 71 posts
Re: Roundcube Webmail 1.2.0 released with PGP support
#2I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
Re: Roundcube Webmail 1.2.0 released with PGP support
#3I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
You don't have to upload the key. It also supports the mailvelope browser extension.
Re: Roundcube Webmail 1.2.0 released with PGP support
#4I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
[deleted]
Re: Roundcube Webmail 1.2.0 released with PGP support
#5I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
Yes, you can revoke the key and publish the revocation. This means that it will be flagged as revoked in the server keys and assuming that senders keep their GPG keybase up to date with server keys, they'll get a warning that this key is out of date. All e-mails already encrypted with the key can still be decrypted though.
As for the second part of your post, you're probably asking about this:
Re: Roundcube Webmail 1.2.0 released with PGP support
#6For everyone who (like me) wondered what happened to "Roundcube Next", they released a statement 8 days ago[1] about it. Sounds like they had personal problems getting in the way. Glad to see the project is still alive.
[1] https://www.indiegogo.com/projects/roundcube-next--2#/update...
Re: Roundcube Webmail 1.2.0 released with PGP support
#7I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
If you don't use the browser extension you would probably only want to use this feature if you control that Roundcube instance yourself because yes if you upload it to the server and your key gets lost all past and future communication with that key is only as secure as your keys password.
Re: Roundcube Webmail 1.2.0 released with PGP support
#8I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
If you generated a revocation certificate, yes, you can revoke it. Otherwise no. The private key is protected (should be) by a password, so even in the event it gets compromised it should be OK.
Encrypted messages from the past are unreadable, unless you have the private key. No private "master" that I know of.
Re: Roundcube Webmail 1.2.0 released with PGP support
#9I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
Encryption is also supported via a browser plugin, so it's not necessary to upload the private key to the server. Regarding your questions:
1) yes, you can revoke the key by generating a revocation certificate and publishing it on a public keyserver (of course, your correspondents would need to refresh the public key from the keyserver to know it was revoked, which is something they might not do);
2) sent and received messages from the past, unfortunately, are readable by the person who is in possession of the private key, if such key is not protected by a strong password;
3) yes, you still need the old private key to read the old messages;
4) you can generate a master key (to be kept strictly offline) and several, frequently rotating subkeys for encryption purposes. It's not a silver bullet solution (in the sense that a thief would still have access to all your subkeys, meaning he could read all your messages up to the point the keys are stolen, but it mitigates the damage somehow). See here: https://alexcabal.com/creating-the-perfect-gpg-keypair
Re: Roundcube Webmail 1.2.0 released with PGP support
#10I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
Actually I think it means support for browser plugins that will handle the PGP part.