3 ms·

But as I'm typing, Gmail is saving my draft automatically to Google servers. Normally, at least. This means Google would have a copy of my email as it existed b

by mapgrep 12y ago

But as I'm typing, Gmail is saving my draft automatically to Google servers. Normally, at least. This means Google would have a copy of my email as it existed before I encrypted it. In your testing, do you see any evidence that this extension prevents Gmail's automatic draft saving?

magicalist 12y ago
In the FAQ they mention "End-To-End doesn’t trust any website's DOM or context with unencrypted data. We have tried to ensure that the interaction between the extension and websites is minimal and does not reveal secrets to the website." I'm curious about this too. Does that mean they somehow insert a textbox that the host page can't see? I didn't realize extensions could do that. Edit: ah, this appears to be where it happens. They insert an iframe the extension owns, so the host page won't be able to see what's in it: https://code.google.com/p/end-to-end/source/browse/javascript/crypto/e2e/extension/ui/glass/glasswrapper.js#68 https://code.google.com/p/end-to-end/source/browse/javascrip...
- mapgrep 12y ago
  Nice find!
- robryk 12y ago
  It would be nice if that got added to PwdHash[1] extension[2]. PwdHash chrome extension currently seems to just try to capture all keyboard events while the master password is entered in a site's password box. Also, it seems to me that it runs in the site's context. [1] https://www.pwdhash.com/ https://www.pwdhash.com/ [2] https://code.google.com/p/chrome-pwdhash/ https://code.google.com/p/chrome-pwdhash/
- sirdogealot 12y ago
  But when displaying the cleartext of a previously sent email or received email... they must be able to decipher the encrypted text in order to display it to the viewer, no?
  - lmm 12y ago
    Sure, the extension can read the encrypted text from the DOM. But it then displays it in an iframe which the original site doesn't have access to.
cryptbe 12y ago
The extension encrypts and saves the drafts in localStorage.
tokenizerrr 12y ago
Not if you choose to first type your message in the textarea on the website, but this is optional. You can also click the extension icon, and begin typing your message in the extension window. That way it never touches the DOM of the target page, but it is slightly less convient.
payaaam 12y ago
Virtru has draft protection in Gmail.

by mapgrep 12y ago

magicalist 12y ago

In the FAQ they mention "End-To-End doesn’t trust any website's DOM or context with unencrypted data. We have tried to ensure that the interaction between the extension and websites is minimal and does not reveal secrets to the website." I'm curious about this too. Does that mean they somehow insert a textbox that the host page can't see? I didn't realize extensions could do that. Edit: ah, this appears to be where it happens. They insert an iframe the extension owns, so the host page won't be able to see what's in it: https://code.google.com/p/end-to-end/source/browse/javascript/crypto/e2e/extension/ui/glass/glasswrapper.js#68 https://code.google.com/p/end-to-end/source/browse/javascrip...

mapgrep 12y ago
Nice find!
robryk 12y ago
It would be nice if that got added to PwdHash[1] extension[2]. PwdHash chrome extension currently seems to just try to capture all keyboard events while the master password is entered in a site's password box. Also, it seems to me that it runs in the site's context. [1] https://www.pwdhash.com/ https://www.pwdhash.com/ [2] https://code.google.com/p/chrome-pwdhash/ https://code.google.com/p/chrome-pwdhash/
sirdogealot 12y ago
But when displaying the cleartext of a previously sent email or received email... they must be able to decipher the encrypted text in order to display it to the viewer, no?
- lmm 12y ago
  Sure, the extension can read the encrypted text from the DOM. But it then displays it in an iframe which the original site doesn't have access to.

cryptbe 12y ago

The extension encrypts and saves the drafts in localStorage.

tokenizerrr 12y ago

Not if you choose to first type your message in the textarea on the website, but this is optional. You can also click the extension icon, and begin typing your message in the extension window. That way it never touches the DOM of the target page, but it is slightly less convient.

payaaam 12y ago

Virtru has draft protection in Gmail.