You have to protect the unencrypted content not just from Gmail, but from any script anyone could potentially add to Gmail or any other service. And this protec

You have to protect the unencrypted content not just from Gmail, but from any script anyone could potentially add to Gmail or any other service. And this protection has to be bulletproof, since the whole point is to not trust the service provider. A lot of work has already been done to prevent cross-site attacks, and if we have Gmail (or whatever) in one tab, and FooAddon in another, it's a pretty safe bet that one tab can't read the other. I'm less sure how you protect part of a page from itself. Maybe putting the edit box in an iframe would work? http://pipwerks.com/2008/10/15/iframes-and-cross-domain-security/ http://pipwerks.com/2008/10/15/iframes-and-cross-domain-secu... Edit: Another option: Focus text box where you want encrypted message to go. Click FooAddon toolbar button. All scripts on the page are stopped, and you can safely type your message. When done, click toolbar button again. The message is replaced with an encrypted version and then scripts are resumed.