2 ms·

Absolutely, but then Gmail would save unencrypted drafts as you type, compromising security. Short of blocking all scripts on the page, I'm not sure how we coul

• pavel_lishin 14y ago
  Have the extension create a new HTML element that gmail isn't tracking; perhaps encrypt it on the fly, and auto-paste the encrypted version into gmail's (hidden by the extension) input. That way, gmail still saves the draft, but the draft is encrypted. Totally making this up off the top of my head, no clue how practical all of this actually is, especially the encryption speed.
  • graue 14y ago
    You have to protect the unencrypted content not just from Gmail, but from any script anyone could potentially add to Gmail or any other service. And this protection has to be bulletproof, since the whole point is to not trust the service provider. A lot of work has already been done to prevent cross-site attacks, and if we have Gmail (or whatever) in one tab, and FooAddon in another, it's a pretty safe bet that one tab can't read the other. I'm less sure how you protect part of a page from itself. Maybe putting the edit box in an iframe would work? http://pipwerks.com/2008/10/15/iframes-and-cross-domain-security/ http://pipwerks.com/2008/10/15/iframes-and-cross-domain-secu... Edit: Another option: Focus text box where you want encrypted message to go. Click FooAddon toolbar button. All scripts on the page are stopped, and you can safely type your message. When done, click toolbar button again. The message is replaced with an encrypted version and then scripts are resumed.