6 ms·

(Simple) Chrome plugin for GPG/PGP in GMail

45 points by mh_ 15y ago

pavpanchekha 15y ago
Neat idea, and I know it's a cute hack, but 1) You ask for all data on my personal computer and all data on all websites. What?! I imagine you might require local data access to get my GPG key and Chrome doesn't allow it more fine-grained than that (but forchrissakes tell me that on your site), but why all sites? Why not mail.google.com and gmail.com? Because of apps for your domain? 2) You're providing a crypto product. I want to see your source code, and don't tell me to unzip/tar/whatever your crx.
- mh_ 15y ago
  Link to the src has been added to the site. (sorry we included it when we mailed the gpg mail list, but didn't add it to the page) Direct Link: https://github.com/RC1140/cr-gpg https://github.com/RC1140/cr-gpg
- mtogo 15y ago
  A quick note, apps for domains are still served from https://mail.google.com/a/example.com/ https://mail.google.com/a/example.com/
pnathan 15y ago
How do you manage your private keys not getting into Javascript land & being POSTed out to an arbitrary site?
- mh_ 15y ago
  We don't store the password in the DOM. When you choose to sign/encrypt, the password is passed to gpg (via the plugin) and promptly goes out of scope. (It means you have to enter your password every time you want to sign/encrypt, but this seems safer)
  - pnathan 15y ago
    Goes...out of scope. I am suspicious that that's not really sufficient password protection. What protection do you have from an attack that provides access to your machine's address space? (or chrome's address space)? I'd like to see the source code before I use this. If that sounds paranoid, it's because if I'm using crypto, it's because I'm concerned about snoopers. --- edit - source got posted. Thanks!
    - mh_ 15y ago
      -nod- an attack with full access to chromes address space would grab the password in memory. I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)
      - caf 15y ago
        Could you mitigate that by having a separate process to do the crypto, which the plugin talks to by IPC? The separate process is then the one that prompts for the password. This would also mean you don't have to reenter your password every time.
    - msbarnett 15y ago
      You're at zero right now because my finger slipped. Sorry about that.
- gst 15y ago
  I don't see a reason why private keys should be accessible via Javascript at all. It's a plugin and not a JS-based extension. With the right API the JS code would never see the private keys.
  - pnathan 15y ago
    Sure. But people make mistakes. And it behooves one to be careful with their crypto. c.f. Zimmarman's Snake Oil essay & its comments today: http://news.ycombinator.com/item?id=2917384 http://news.ycombinator.com/item?id=2917384
- mike-cardwell 15y ago
  If your keys are on a smartcard, you don't need to worry about that. The OS couldn't give up your keys even if it wanted to.
mh_ 15y ago
The plugin has 2 quick updates: a) It's now site restricted to mail.google.com b) Will make use of chromes update feature in the future. Please grab the new version from http://thinkst.com/tools/cr-gpg/ http://thinkst.com/tools/cr-gpg/

45 points by mh_ 15y ago

Neat idea, and I know it's a cute hack, but 1) You ask for all data on my personal computer and all data on all websites. What?! I imagine you might require local data access to get my GPG key and Chrome doesn't allow it more fine-grained than that (but forchrissakes tell me that on your site), but why all sites? Why not mail.google.com and gmail.com? Because of apps for your domain? 2) You're providing a crypto product. I want to see your source code, and don't tell me to unzip/tar/whatever your crx.

mh_ 15y ago
Link to the src has been added to the site. (sorry we included it when we mailed the gpg mail list, but didn't add it to the page) Direct Link: https://github.com/RC1140/cr-gpg https://github.com/RC1140/cr-gpg
mtogo 15y ago
A quick note, apps for domains are still served from https://mail.google.com/a/example.com/ https://mail.google.com/a/example.com/

pnathan 15y ago

How do you manage your private keys not getting into Javascript land & being POSTed out to an arbitrary site?

mh_ 15y ago
We don't store the password in the DOM. When you choose to sign/encrypt, the password is passed to gpg (via the plugin) and promptly goes out of scope. (It means you have to enter your password every time you want to sign/encrypt, but this seems safer)
- pnathan 15y ago
  Goes...out of scope. I am suspicious that that's not really sufficient password protection. What protection do you have from an attack that provides access to your machine's address space? (or chrome's address space)? I'd like to see the source code before I use this. If that sounds paranoid, it's because if I'm using crypto, it's because I'm concerned about snoopers. --- edit - source got posted. Thanks!
  - mh_ 15y ago
    -nod- an attack with full access to chromes address space would grab the password in memory. I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)
    - caf 15y ago
      Could you mitigate that by having a separate process to do the crypto, which the plugin talks to by IPC? The separate process is then the one that prompts for the password. This would also mean you don't have to reenter your password every time.
  - msbarnett 15y ago
    You're at zero right now because my finger slipped. Sorry about that.
gst 15y ago
I don't see a reason why private keys should be accessible via Javascript at all. It's a plugin and not a JS-based extension. With the right API the JS code would never see the private keys.
- pnathan 15y ago
  Sure. But people make mistakes. And it behooves one to be careful with their crypto. c.f. Zimmarman's Snake Oil essay & its comments today: http://news.ycombinator.com/item?id=2917384 http://news.ycombinator.com/item?id=2917384
mike-cardwell 15y ago
If your keys are on a smartcard, you don't need to worry about that. The OS couldn't give up your keys even if it wanted to.

mh_ 15y ago

The plugin has 2 quick updates: a) It's now site restricted to mail.google.com b) Will make use of chromes update feature in the future. Please grab the new version from http://thinkst.com/tools/cr-gpg/ http://thinkst.com/tools/cr-gpg/