9 ms·

End-to-End Encryption Plugin for Yahoo Mail

228 points by danielweber 12y ago

zobzu 12y ago
Rather to compare E2E with Mac GpgTools, I'd try to compare it with https://www.mailvelope.com/ https://www.mailvelope.com/ which is a much better comparison since both are addons for browsers. Mailvelope works both on Firefox and Chrome (ironically, the Yahoo plugin seems to only have Chrome support at the moment) and is actually even nicer to use (read: seamless) than E2E IMO.
- barnaby 12y ago
  Yeah, I use mailvelope with my close friends and family. It's not yet easy enough for my parents generation to "get it" but if it's set up for them they can muster through it. The problem with plugins though is that very few people go out of their way to install browser plugins. Having an integrated option is way more useful. So some people have to encrypt/decrypt in-browser using Javascript (like, how tutanota and protonmail do it, or like whiteout.io does, or like anybody can do now using the keynote.io API). I know it's not ideal, but it is way better than nothing. It won't stop the NSA, but it will stop hackers, email leakers, doxxers, and big-data email-mining algorithms.
- ausjke 12y ago
  Not aware of this, looks great! Thanks.
nullspace 12y ago
Can someone give an explanation of how this works? In order to get this to be seamless, I would guess that this only works when you are sending from one yahoo account to another one correct? Unless they have found a clever way to share the public keys.
- hspak 12y ago
  It looks like they forked Google's end-to-end Chrome extension. Best place to look would probably be the docs for google's e2e. https://github.com/google/end-to-end/wiki https://github.com/google/end-to-end/wiki
- happyfuncube 12y ago
  Yahoo Paranoids Engineering Director for end-to-end here. Today our extension works as a developer only demo, and no Yahoo keyserver service is online yet. If our toy keyserver code didn't make it into this release, you will see it very soon and will be able to experiment. We released the source so we can solicit security feedback early, and can keep all security and privacy critical parts of this product in the open. No "just trust us" now or in the future. Along those lines, we will work with industry peers to build public key registry software that interoperates with other federated providers, is open source, and is transparent in the cryptographic sense. I.e. Yahoo and Google users should be able to send encrypted email to one another with ease, and if either company was forced to lie about the public keys of our respective users we would be caught because math. There's a lot more in the works, and we have many challenges to overcome to make this generally usable. In addition to the key server, there's not unnecessarily breaking existing mail features, multi-device issues, search over encrypted content w/o providers being able to read it, and mobile support to start. If you know anyone with the skills and motivation to make strong, usable encryption available at internet scale we'd love to listen, collaborate, or hire. :)
  - barnaby 12y ago
    This is very cool. Thank you for working on it. I do know a team whom you should work with: keybase.io Keybase.io have an early-level product which would help with your keyserver issue. It has a CORS-enabled API, a commandline tool, an online interface for encrypting, signing, verifying, etc. and a "ring of trust" tool that follows the modern social network model (where, you can "track" somebody and it auto-signs their keys each time they upgrade.
  - deanclatworthy 12y ago
    Except that we cannot verify that you actually deploy the "open" code. It's obviously commendable that you do development in the open, and have people review the work you do. But there is no way for us to know that you don't run /addNSAbackdoor.sh in your deploy script for key parts of your infrastructure. There is already published docs that show Yahoo is/was part of Prism since 2008: http://www.wired.com/2014/09/feds-yahoo-fine-prism/ http://www.wired.com/2014/09/feds-yahoo-fine-prism/
mrb 12y ago
Little known fact: Google's End-to-end encryption extension already works on any site. It is not limited to Gmail. In fact it's not limited to webmail either. If a PGP blob is present in a web page, End-to-end can decrypt it. If a text input area is present in a web page, End-to-end can encrypt it.
- runn1ng 12y ago
  I have no idea how to get that extension or how to install it. Is there some simple guide? edit: all I see here https://github.com/google/end-to-end https://github.com/google/end-to-end is We’re releasing this code to enable community review; it is not yet ready for general use
  - nacs 12y ago
    They have a Wiki that has build/install instructions: https://github.com/google/end-to-end/wiki/Build-instructions https://github.com/google/end-to-end/wiki/Build-instructions. Basically, clone the Git repo then do: ./do.sh install_deps ./do.sh build_extension This results in an extension folder that can be installed via Chrome's developer mode. Disclaimer: not affiliated in any way and never used it myself
    - Fastidious 12y ago
      That is the way I built it. I wanted to add that java is required.
  - tim333 12y ago
    Interesting that they've had a vulnerability reward program since June 2014. I wonder how that's getting on http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html http://googleonlinesecurity.blogspot.com/2014/06/making-end-...
    - sondh 12y ago
      They provided an update last December[1] and stated that two rewards have been given. The same update is also interesting because it mentioned the migration from Google Code to Github (three months ago!). The blog post talked about Yahoo! contribution to the project too... [1] http://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html http://googleonlinesecurity.blogspot.com/2014/12/an-update-t...
deleted 12y ago
[deleted]
- deleted 12y ago
  [deleted]
snassar 12y ago
It is worth noting that the Yahoo! devs do not promise OpenPGP (RFC 4880) compatibility in the future.
asdz 12y ago
now take my public and private key Yahoo!

228 points by danielweber 12y ago

zobzu 12y ago

Rather to compare E2E with Mac GpgTools, I'd try to compare it with https://www.mailvelope.com/ https://www.mailvelope.com/ which is a much better comparison since both are addons for browsers. Mailvelope works both on Firefox and Chrome (ironically, the Yahoo plugin seems to only have Chrome support at the moment) and is actually even nicer to use (read: seamless) than E2E IMO.

barnaby 12y ago
Yeah, I use mailvelope with my close friends and family. It's not yet easy enough for my parents generation to "get it" but if it's set up for them they can muster through it. The problem with plugins though is that very few people go out of their way to install browser plugins. Having an integrated option is way more useful. So some people have to encrypt/decrypt in-browser using Javascript (like, how tutanota and protonmail do it, or like whiteout.io does, or like anybody can do now using the keynote.io API). I know it's not ideal, but it is way better than nothing. It won't stop the NSA, but it will stop hackers, email leakers, doxxers, and big-data email-mining algorithms.
ausjke 12y ago
Not aware of this, looks great! Thanks.

nullspace 12y ago

Can someone give an explanation of how this works? In order to get this to be seamless, I would guess that this only works when you are sending from one yahoo account to another one correct? Unless they have found a clever way to share the public keys.

hspak 12y ago
It looks like they forked Google's end-to-end Chrome extension. Best place to look would probably be the docs for google's e2e. https://github.com/google/end-to-end/wiki https://github.com/google/end-to-end/wiki
happyfuncube 12y ago
Yahoo Paranoids Engineering Director for end-to-end here. Today our extension works as a developer only demo, and no Yahoo keyserver service is online yet. If our toy keyserver code didn't make it into this release, you will see it very soon and will be able to experiment. We released the source so we can solicit security feedback early, and can keep all security and privacy critical parts of this product in the open. No "just trust us" now or in the future. Along those lines, we will work with industry peers to build public key registry software that interoperates with other federated providers, is open source, and is transparent in the cryptographic sense. I.e. Yahoo and Google users should be able to send encrypted email to one another with ease, and if either company was forced to lie about the public keys of our respective users we would be caught because math. There's a lot more in the works, and we have many challenges to overcome to make this generally usable. In addition to the key server, there's not unnecessarily breaking existing mail features, multi-device issues, search over encrypted content w/o providers being able to read it, and mobile support to start. If you know anyone with the skills and motivation to make strong, usable encryption available at internet scale we'd love to listen, collaborate, or hire. :)
- barnaby 12y ago
  This is very cool. Thank you for working on it. I do know a team whom you should work with: keybase.io Keybase.io have an early-level product which would help with your keyserver issue. It has a CORS-enabled API, a commandline tool, an online interface for encrypting, signing, verifying, etc. and a "ring of trust" tool that follows the modern social network model (where, you can "track" somebody and it auto-signs their keys each time they upgrade.
- deanclatworthy 12y ago
  Except that we cannot verify that you actually deploy the "open" code. It's obviously commendable that you do development in the open, and have people review the work you do. But there is no way for us to know that you don't run /addNSAbackdoor.sh in your deploy script for key parts of your infrastructure. There is already published docs that show Yahoo is/was part of Prism since 2008: http://www.wired.com/2014/09/feds-yahoo-fine-prism/ http://www.wired.com/2014/09/feds-yahoo-fine-prism/

mrb 12y ago

Little known fact: Google's End-to-end encryption extension already works on any site. It is not limited to Gmail. In fact it's not limited to webmail either. If a PGP blob is present in a web page, End-to-end can decrypt it. If a text input area is present in a web page, End-to-end can encrypt it.

runn1ng 12y ago
I have no idea how to get that extension or how to install it. Is there some simple guide? edit: all I see here https://github.com/google/end-to-end https://github.com/google/end-to-end is We’re releasing this code to enable community review; it is not yet ready for general use
- nacs 12y ago
  They have a Wiki that has build/install instructions: https://github.com/google/end-to-end/wiki/Build-instructions https://github.com/google/end-to-end/wiki/Build-instructions. Basically, clone the Git repo then do: ./do.sh install_deps ./do.sh build_extension This results in an extension folder that can be installed via Chrome's developer mode. Disclaimer: not affiliated in any way and never used it myself
  - Fastidious 12y ago
    That is the way I built it. I wanted to add that java is required.
- tim333 12y ago
  Interesting that they've had a vulnerability reward program since June 2014. I wonder how that's getting on http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html http://googleonlinesecurity.blogspot.com/2014/06/making-end-...
  - sondh 12y ago
    They provided an update last December[1] and stated that two rewards have been given. The same update is also interesting because it mentioned the migration from Google Code to Github (three months ago!). The blog post talked about Yahoo! contribution to the project too... [1] http://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html http://googleonlinesecurity.blogspot.com/2014/12/an-update-t...

deleted 12y ago

[deleted]

deleted 12y ago
[deleted]

snassar 12y ago

It is worth noting that the Yahoo! devs do not promise OpenPGP (RFC 4880) compatibility in the future.

asdz 12y ago

now take my public and private key Yahoo!