4 ms·
Someone needs to invent a Firefox or Chrome addon that solves this problem. Here's how I see it working. You get a message on Gmail, and it looks like this:
by graue 14y ago
Someone needs to invent a Firefox or Chrome addon that solves this problem.
Here's how I see it working. You get a message on Gmail, and it looks like this:
This message is encrypted with FooAddon.
To view it, copy and paste the encrypted message
to a FooAddon tab.
----FOOADDON MESSAGE START
...a bunch of base64-encoded binary data...
----FOOADDON MESSAGE END
You paste that into the addon's tab and it uses your private key to decrypt and show the message.
To send, you select the recipient's public key in a FooAddon tab and type your message there, then click Encrypt. It gives you something like the above which you then copy and paste back into Gmail.
Clumsy, yes, but you'd have a working proof-of-concept that would allow you to send and receive encrypted messages through any website with a text field without leaving the browser.
The security implications of being able to type a secure message directly in Gmail and be sure Google isn't reading it with JavaScript are no doubt much more complicated.
- jmillikin 14y agohttp://www.mozilla.org/en-US/thunderbird/ http://www.mozilla.org/en-US/thunderbird/ https://addons.mozilla.org/en-us/thunderbird/addon/enigmail/ https://addons.mozilla.org/en-us/thunderbird/addon/enigmail/
- graue 14y agoSince you missed it, the key point of my proposal was that it works: > through any website with a text field > without leaving the browser
- jmillikin 14y agoI don't consider either of those to be useful, because once you've had to open a new window/tab, you might as well just have opened another application. This recent obsession with rewriting the world to run in a jumped-up document rendering system is unhealthy and insane.
- graue 14y agoIt's a question of adoption. Asking people to install a browser addon is easier and less hassle than a whole new application. I use Thunderbird myself, but if we want email encryption available to everyone - not just us geeks - then the simpler we can make it, the better.
- pavel_lishin 14y agoIt might be easier to just have the add-on work with the on-screen HTML directly.
- graue 14y agoAbsolutely, but then Gmail would save unencrypted drafts as you type, compromising security. Short of blocking all scripts on the page, I'm not sure how we could prevent a server-side backdoor.
- pavel_lishin 14y agoHave the extension create a new HTML element that gmail isn't tracking; perhaps encrypt it on the fly, and auto-paste the encrypted version into gmail's (hidden by the extension) input. That way, gmail still saves the draft, but the draft is encrypted. Totally making this up off the top of my head, no clue how practical all of this actually is, especially the encryption speed.
- graue 14y agoYou have to protect the unencrypted content not just from Gmail, but from any script anyone could potentially add to Gmail or any other service. And this protection has to be bulletproof, since the whole point is to not trust the service provider. A lot of work has already been done to prevent cross-site attacks, and if we have Gmail (or whatever) in one tab, and FooAddon in another, it's a pretty safe bet that one tab can't read the other. I'm less sure how you protect part of a page from itself. Maybe putting the edit box in an iframe would work? http://pipwerks.com/2008/10/15/iframes-and-cross-domain-security/ http://pipwerks.com/2008/10/15/iframes-and-cross-domain-secu... Edit: Another option: Focus text box where you want encrypted message to go. Click FooAddon toolbar button. All scripts on the page are stopped, and you can safely type your message. When done, click toolbar button again. The message is replaced with an encrypted version and then scripts are resumed.