3 ms·
I have been working on this for few months now. It is a CR/FF/SF browser extension which should work with gmail/yahoomail/hotmail. Please get in touch with me i
by SriniK 16y ago
I have been working on this for few months now. It is a CR/FF/SF browser extension which should work with gmail/yahoomail/hotmail. Please get in touch with me if you like to be notified - skommoori (at) gmail.com
Recently, I have pitched the idea to few people both in angel community and some of my friends and tc disrupt visitor friends that I met. As few users have mentioned in the comments, it really boils down to people having awareness. People who are familiar with the encryption see the value immediately and people with no knowledge start to question why they need security. I have decided to go release the product. It is encouraging to see someone really cares about this stuff.
When I saw the gmail/china hacking fiasco, it is so much frustrating to see how dumb found we as users are left even though matured standards (rfc822, SMIME, OpenPGP)exist. Hopefully, what I am working would solve the exact issue we have been facing and no one is working on this non sexy item.
On the technical/details side, not just encrypting the text, it is more important to encrypt the whole message including attachments. Rightnow I have the prototype which works for text message and trying to expand it to cover attachments. The problem with FireGPG or few other things that I tried include how painful it is to setup and maintain - I also think, that being the reason for not getting popularity. There are already quite a few libraries for RSA, AES, HMAC(pick your language of choice). Implementing the plugin with Javascript has serious performance and security (good luck supporting OpenPGP). So core items need to be implemented in compiled language - for me they are in C/C++. I would love to share more details about the core crypto stuff if you want to.
- tptacek 16y agoWhen you talk about "RSA, AES, HMAC", you leave me to wonder whether you're actually implementing a standard like PGP or S/MIME, or whether you've invented your own encryption scheme. I hope for your sake it's former, and not the latter. Know that most large companies do use encrypted mail, and have a standard that their partners must use.
- SriniK 16y agoYes. I am going to support OpenPGP. As you said, inventing own encryption is not a smart thing to do.
- baltcode 16y agoGreat to know someone is working on it. If it is in C/C++, the user has to download a program, and it is not simple webmail. Secondly, what about the private keys? Do we have to remember them? The reason pgp has not caught on for most people is because we dont want to go through a complicated mail client installation. If your solution is simpler/easier to install, that's a plus. However, I should be able to access my secure mail through computers not my own. Is your compiled solution open source or can it be certified secure? i.e., that it is not sending the unencrypted private key or passphrase to some backdoor? These are all issues to keep in mind. Would love to see your product. Good luck!
- SriniK 16y agoIt is an extension that you download for the browsers - Chrome/FF/Safari are targeted. Yes you can access your encrypted mail from your computer, friends computer, etc.. Generating and Managing keys and all other logistics are something I think we will add to the value of already existing OpenPGP protocol. I will definitely go through app signing and code verifying by outside agencies(so users are sure of authenticity) My motto is, even grandma should be able start encrypting emails :)