5 ms·

Question to anyone: how hard it would be to integrate pgp (or pgp-like) thing on browser level? would immediately solve all the headache. let's say: Special UI

Question to anyone: how hard it would be to integrate pgp (or pgp-like) thing on browser level? would immediately solve all the headache. let's say: Special UI for storing private/public pairs in a browser (private key never leaves the PC) special javascript commands (assume some standard here) to invoke native windows which can not be controlled via js. sign, type message, encrypt. confirm this specific message is actually signed by specific person (pretty trivial in terms of coding and bulletproof UI, except for "public identity storage" part which exceptionally hard). Looks like very simple htmlsomething standard could overturn all the state of modern web privacy.

out_of_protocol 11y ago
Someone (like gmail) can even do rich text editor for emails and stuff - without compromising security. let's say separate sandbox w/o internet and write access to cookies etc. load scripts, css, images. show native window (clearly different than anything js can do) with that rich text editor inside. user types message in, system encrypts (and/or signs) the message. regular html page sees the result.
- robryk 11y ago
  There is a Chrome extension that does something like that: https://github.com/google/end-to-end https://github.com/google/end-to-end Obligatory warning: it's in an alpha state according to the readme, so you shouldn't use it yet for real.
legulere 11y ago
Or you know, just use a email client and use S/MIME which most email clients support.
- jMyles 11y ago
  Yeah, but then it's a pain when you want to check your email from a friend's computer or something.
  - legulere 11y ago
    How rare is that? Basically everyone has a phone today with an email client. You shouldn't do that anyway because you're giving your password (and your keys if you encrypt!) away with that. The problems are that some people hate the certification scheme of S/MIME and use GPG which isn't better at all. Then it's user unfriendly to generate the certificates (if you want to be a good email provider, do the job to provide your users with signing of certs) cert and to get them onto all of your devices (I'm looking at you Apple!).
    - jMyles 11y ago
      Not terribly rare for me - I probably do it about once a week. Currently my threat-and-countermeasure model doesn't include obfuscation from the eyes of state actors. I do want to change that, though, so I'll have to break this habit.
0XAFFE 11y ago
Have a look at mailvelope[1]. It enables you to use gpg in your browser. Two larger german e-mail providers (gmx and web.de) even integrated it into their web interface[2]. [1] https://www.mailvelope.com/ https://www.mailvelope.com/ [2] https://www.mailvelope.com/en/blog/gmx-and-web-de-launch-pgp https://www.mailvelope.com/en/blog/gmx-and-web-de-launch-pgp

out_of_protocol 11y ago

Someone (like gmail) can even do rich text editor for emails and stuff - without compromising security. let's say separate sandbox w/o internet and write access to cookies etc. load scripts, css, images. show native window (clearly different than anything js can do) with that rich text editor inside. user types message in, system encrypts (and/or signs) the message. regular html page sees the result.

robryk 11y ago
There is a Chrome extension that does something like that: https://github.com/google/end-to-end https://github.com/google/end-to-end Obligatory warning: it's in an alpha state according to the readme, so you shouldn't use it yet for real.

legulere 11y ago

Or you know, just use a email client and use S/MIME which most email clients support.

jMyles 11y ago
Yeah, but then it's a pain when you want to check your email from a friend's computer or something.
- legulere 11y ago
  How rare is that? Basically everyone has a phone today with an email client. You shouldn't do that anyway because you're giving your password (and your keys if you encrypt!) away with that. The problems are that some people hate the certification scheme of S/MIME and use GPG which isn't better at all. Then it's user unfriendly to generate the certificates (if you want to be a good email provider, do the job to provide your users with signing of certs) cert and to get them onto all of your devices (I'm looking at you Apple!).
  - jMyles 11y ago
    Not terribly rare for me - I probably do it about once a week. Currently my threat-and-countermeasure model doesn't include obfuscation from the eyes of state actors. I do want to change that, though, so I'll have to break this habit.

0XAFFE 11y ago

Have a look at mailvelope[1]. It enables you to use gpg in your browser. Two larger german e-mail providers (gmx and web.de) even integrated it into their web interface[2]. [1] https://www.mailvelope.com/ https://www.mailvelope.com/ [2] https://www.mailvelope.com/en/blog/gmx-and-web-de-launch-pgp https://www.mailvelope.com/en/blog/gmx-and-web-de-launch-pgp