4 ms·

Does anybody use an extension like this for their email? I have always been turned off by horror stories of Chrome extensions being bought out and injected with

Does anybody use an extension like this for their email? I have always been turned off by horror stories of Chrome extensions being bought out and injected with malware[1]. I would love to have my email encrypted easily, but not at the cost of opening a new attack vector that could bypass that encryption. What open source extensions are there that can be installed locally? [1] https://arstechnica.com/information-technology/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/ https://arstechnica.com/information-technology/2014/01/malwa...

xfer 9y ago
What do you mean by "extensions are there that can be installed locally"? Depends on what mail client you are using. Thunderbird can do this. I use mu with emacs mu4e and it just works. You need gpg installed, that's all.
- wakamoleguy 9y ago
  FlowCrypt operates as a Chrome extension, so I assumed that the email client in question was the Gmail web client (or Inbox by Gmail). One can install extensions from the local filesystem rather than the Chrome store, which removes the threat of autoupdating into adware or malware. However, I don't know of any open source crypto extensions built to be installed that way. FlowCrypt might work, but the licensing terms don't seem amenable to that approach.
  - tom-jh 9y ago
    FlowCrypt dev here. You're free to get the source code from https://github.com/FlowCrypt https://github.com/FlowCrypt and load the extension that way. If you plan to also edit the code, just cross-check to stay within the bounds bounds of https://github.com/FlowCrypt/flowcrypt-browser/blob/master/LICENSE https://github.com/FlowCrypt/flowcrypt-browser/blob/master/L...
sb8244 9y ago
All chrome extensions can be copied and installed locally...Assuming the source code doesn't protect against something like this. You could take this extension, copy the obfuscated source, then load it locally to avoid auto updating in the future. Chrome generally doesn't like apps that load their bg page scripts via web requests to help increase security. So it's likely that they aren't doing this.
byterollingbits 9y ago
Encryption is a joke. It's easier just to be a humane person, to treat others well... nope, they instead have to be total fucktards. Not like you all weren't warned already. Imagine what you use for encryption. Now imagine a stick of butter and a hot butter knife melting through that butter. That's how easy it is to break your encryption.
tom-jh 9y ago
FlowCrypt dev here. The sources are available at https://github.com/FlowCrypt https://github.com/FlowCrypt . You can just install it from the sources, but you'll lose the security updates.

xfer 9y ago

What do you mean by "extensions are there that can be installed locally"? Depends on what mail client you are using. Thunderbird can do this. I use mu with emacs mu4e and it just works. You need gpg installed, that's all.

wakamoleguy 9y ago
FlowCrypt operates as a Chrome extension, so I assumed that the email client in question was the Gmail web client (or Inbox by Gmail). One can install extensions from the local filesystem rather than the Chrome store, which removes the threat of autoupdating into adware or malware. However, I don't know of any open source crypto extensions built to be installed that way. FlowCrypt might work, but the licensing terms don't seem amenable to that approach.
- tom-jh 9y ago
  FlowCrypt dev here. You're free to get the source code from https://github.com/FlowCrypt https://github.com/FlowCrypt and load the extension that way. If you plan to also edit the code, just cross-check to stay within the bounds bounds of https://github.com/FlowCrypt/flowcrypt-browser/blob/master/LICENSE https://github.com/FlowCrypt/flowcrypt-browser/blob/master/L...

sb8244 9y ago

All chrome extensions can be copied and installed locally...Assuming the source code doesn't protect against something like this. You could take this extension, copy the obfuscated source, then load it locally to avoid auto updating in the future. Chrome generally doesn't like apps that load their bg page scripts via web requests to help increase security. So it's likely that they aren't doing this.

byterollingbits 9y ago

Encryption is a joke. It's easier just to be a humane person, to treat others well... nope, they instead have to be total fucktards. Not like you all weren't warned already. Imagine what you use for encryption. Now imagine a stick of butter and a hot butter knife melting through that butter. That's how easy it is to break your encryption.

tom-jh 9y ago

FlowCrypt dev here. The sources are available at https://github.com/FlowCrypt https://github.com/FlowCrypt . You can just install it from the sources, but you'll lose the security updates.