3 ms·

I don't understand why webmail seems to be such a conundrum for everyone. Can't we just write plugins that looks for encrypted messages, and signatures in a pag

by joshuak 13y ago

I don't understand why webmail seems to be such a conundrum for everyone. Can't we just write plugins that looks for encrypted messages, and signatures in a page or ajax request and if you have the key in your keychain you get promoted for it. It seems like this would be an even easier plugin then the Mail.app one. That being said I think the real solution is OS level integration. Perhaps a facebook app to help grandma with web of trust.

jarrett 13y ago
The issue is that plugins must generally be written in JavaScript. It's generally felt that, at least with the current state of technology, in-browser JavaScript interpreters haven't been sufficiently vetted to trust with crypto. For more details on this point: http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/
- joshuak 13y ago
  Wow this answer is really disconcerting. Are we really so javascript/web programming oriented now that "plug-in" connotes javascript? No I am not talking about JavaScript. I am talking about an actual application level plugin. Think flash, and silverlight not greasemonky. GPG mail is a plug-in to Mall.app. My point is why not a similar browser plugin.
  - jarrett 13y ago
    > Are we really so javascript/web programming oriented now that "plug-in" connotes javascript? Yes, afraid so. > I am talking about an actual application level plugin. Think flash, and silverlight not greasemonky. This is absolutely an option. It's a tall order, because there are a lot of browser/OS combinations out there. But I believe it could be very successful.
DanBC 13y ago
There's some stuff about trust of keys. When Alice uses Bob's public key she has to know that it actually is Bob's key. Looking at other password / certificate mistakes (people use 123456 as a password for important accounts, people click through warnings) I think this might be harder than it seems. See for example some of the hoax accounts on Twitter. People do get confused, even though it should be easy enough to spot the real account over the hoax account. Online reputation and trust is important. It's a shame that Klout (totally irrelevant to this) is what most people think of when I say 'online reputation'.

by joshuak 13y ago

jarrett 13y ago

The issue is that plugins must generally be written in JavaScript. It's generally felt that, at least with the current state of technology, in-browser JavaScript interpreters haven't been sufficiently vetted to trust with crypto. For more details on this point: http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/

joshuak 13y ago
Wow this answer is really disconcerting. Are we really so javascript/web programming oriented now that "plug-in" connotes javascript? No I am not talking about JavaScript. I am talking about an actual application level plugin. Think flash, and silverlight not greasemonky. GPG mail is a plug-in to Mall.app. My point is why not a similar browser plugin.
- jarrett 13y ago
  > Are we really so javascript/web programming oriented now that "plug-in" connotes javascript? Yes, afraid so. > I am talking about an actual application level plugin. Think flash, and silverlight not greasemonky. This is absolutely an option. It's a tall order, because there are a lot of browser/OS combinations out there. But I believe it could be very successful.

DanBC 13y ago

There's some stuff about trust of keys. When Alice uses Bob's public key she has to know that it actually is Bob's key. Looking at other password / certificate mistakes (people use 123456 as a password for important accounts, people click through warnings) I think this might be harder than it seems. See for example some of the hoax accounts on Twitter. People do get confused, even though it should be easy enough to spot the real account over the hoax account. Online reputation and trust is important. It's a shame that Klout (totally irrelevant to this) is what most people think of when I say 'online reputation'.