5 ms·

Little known fact: Google's End-to-end encryption extension already works on any site. It is not limited to Gmail. In fact it's not limited to webmail either. I

by mrb 12y ago

Little known fact: Google's End-to-end encryption extension already works on any site. It is not limited to Gmail. In fact it's not limited to webmail either. If a PGP blob is present in a web page, End-to-end can decrypt it. If a text input area is present in a web page, End-to-end can encrypt it.

runn1ng 12y ago
I have no idea how to get that extension or how to install it. Is there some simple guide? edit: all I see here https://github.com/google/end-to-end https://github.com/google/end-to-end is We’re releasing this code to enable community review; it is not yet ready for general use
- nacs 12y ago
  They have a Wiki that has build/install instructions: https://github.com/google/end-to-end/wiki/Build-instructions https://github.com/google/end-to-end/wiki/Build-instructions. Basically, clone the Git repo then do: ./do.sh install_deps ./do.sh build_extension This results in an extension folder that can be installed via Chrome's developer mode. Disclaimer: not affiliated in any way and never used it myself
  - Fastidious 12y ago
    That is the way I built it. I wanted to add that java is required.
- tim333 12y ago
  Interesting that they've had a vulnerability reward program since June 2014. I wonder how that's getting on http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html http://googleonlinesecurity.blogspot.com/2014/06/making-end-...
  - sondh 12y ago
    They provided an update last December[1] and stated that two rewards have been given. The same update is also interesting because it mentioned the migration from Google Code to Github (three months ago!). The blog post talked about Yahoo! contribution to the project too... [1] http://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html http://googleonlinesecurity.blogspot.com/2014/12/an-update-t...
- alkonaut 12y ago
  A Windows build environment is not supported. Wonder what they thougt there? Windows is where the majority of users are, it's where the people who can't (or don't want to) use command line tools for encryption are. Why would you even approach this from a Linux-first angle? I'd understand if it was because the developers are typically Linux users and they want it thuroughly tested before shipping a user friendly version (i.e chrome ext for windows).
  - sarciszewski 12y ago
    It's not ready for consumers yet. The end result will be a Chrome extension anyway.
SilasX 12y ago
Littler-known fact: if you are serious about protecting that message, then web based email can't really do it. So long as the server has access to your plaintext as you compose it, the security is compromised and a third party has it. And then if the recipient views the plaintext from a browser... If you want the email to be secret, it must be in it's encrypted form before the browser even knows about it ... but at that point, why not just use a different, well vetted client program for email?
- EC1 12y ago
  > but at that point, why not just use a different, well vetted client program for email? Anyone have any names?
  - moe 12y ago
    Mutt and Thunderbird come to mind.
    - jvehent 12y ago
      GPG in Mutt is fantastically well integrated. Now, of course, you have to get used to Mutt first :)
      - middleclick 12y ago
        Thunderbird with Enigmial also works quite well. I use it everyday.
    - ekianjo 12y ago
      Clawsmail as well :)
  - barnaby 12y ago
    Whiteout.io is a chrome app for email, plus an android app with key-synch between the two. It's still early stages, so it has some issues (like indexing all your emails, since forever, and overheating your computer). But it's very promising. Most people want to continue using webmail though. That's why Mailvelope is so awesome. Continue using webmail, but just have an extra button added which opens up an editor with a bit "encrypt" button. Pretty easy, and pretty safe.
higherpurpose 12y ago
Yeah, I got the feeling this only works with Yahoo Mail. That's pretty disappointing. Is it really that much harder to make it work across at least the big email providers, while still being able to remove that setting-up the private key and sharing the public key confusion that people get when using PGP? Or is it more of a political/collaboration issue (the big companies don't want to work together on this)?

by mrb 12y ago

runn1ng 12y ago

I have no idea how to get that extension or how to install it. Is there some simple guide? edit: all I see here https://github.com/google/end-to-end https://github.com/google/end-to-end is We’re releasing this code to enable community review; it is not yet ready for general use

nacs 12y ago
They have a Wiki that has build/install instructions: https://github.com/google/end-to-end/wiki/Build-instructions https://github.com/google/end-to-end/wiki/Build-instructions. Basically, clone the Git repo then do: ./do.sh install_deps ./do.sh build_extension This results in an extension folder that can be installed via Chrome's developer mode. Disclaimer: not affiliated in any way and never used it myself
- Fastidious 12y ago
  That is the way I built it. I wanted to add that java is required.
tim333 12y ago
Interesting that they've had a vulnerability reward program since June 2014. I wonder how that's getting on http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html http://googleonlinesecurity.blogspot.com/2014/06/making-end-...
- sondh 12y ago
  They provided an update last December[1] and stated that two rewards have been given. The same update is also interesting because it mentioned the migration from Google Code to Github (three months ago!). The blog post talked about Yahoo! contribution to the project too... [1] http://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html http://googleonlinesecurity.blogspot.com/2014/12/an-update-t...
alkonaut 12y ago
A Windows build environment is not supported. Wonder what they thougt there? Windows is where the majority of users are, it's where the people who can't (or don't want to) use command line tools for encryption are. Why would you even approach this from a Linux-first angle? I'd understand if it was because the developers are typically Linux users and they want it thuroughly tested before shipping a user friendly version (i.e chrome ext for windows).
- sarciszewski 12y ago
  It's not ready for consumers yet. The end result will be a Chrome extension anyway.

SilasX 12y ago

Littler-known fact: if you are serious about protecting that message, then web based email can't really do it. So long as the server has access to your plaintext as you compose it, the security is compromised and a third party has it. And then if the recipient views the plaintext from a browser... If you want the email to be secret, it must be in it's encrypted form before the browser even knows about it ... but at that point, why not just use a different, well vetted client program for email?

EC1 12y ago
> but at that point, why not just use a different, well vetted client program for email? Anyone have any names?
- moe 12y ago
  Mutt and Thunderbird come to mind.
  - jvehent 12y ago
    GPG in Mutt is fantastically well integrated. Now, of course, you have to get used to Mutt first :)
    - middleclick 12y ago
      Thunderbird with Enigmial also works quite well. I use it everyday.
  - ekianjo 12y ago
    Clawsmail as well :)
- barnaby 12y ago
  Whiteout.io is a chrome app for email, plus an android app with key-synch between the two. It's still early stages, so it has some issues (like indexing all your emails, since forever, and overheating your computer). But it's very promising. Most people want to continue using webmail though. That's why Mailvelope is so awesome. Continue using webmail, but just have an extra button added which opens up an editor with a bit "encrypt" button. Pretty easy, and pretty safe.

higherpurpose 12y ago

Yeah, I got the feeling this only works with Yahoo Mail. That's pretty disappointing. Is it really that much harder to make it work across at least the big email providers, while still being able to remove that setting-up the private key and sharing the public key confusion that people get when using PGP? Or is it more of a political/collaboration issue (the big companies don't want to work together on this)?