Google Open Sources Encrypted Email Extension For Chrome (onthewire.io) 44
Last week Google released E2EMail, "a Gmail client that exchanges OpenPGP mail." Google's documentation promises that "Any email sent from the app is also automatically signed and encrypted... The target is a simple user experience -- install app, approve permissions, start reading or send sending messages." Trailrunner7 quotes On The Wire:
People have been trying to find a replacement for PGP almost since the day it was released, and with limited success. Encrypted email is still difficult to use and painful to implement in most cases, but Google has just released a Chrome plugin designed to address those problems.
The new E2EMail extension doesn't turn a user's Gmail inbox into an encrypted mail client. Rather, it is a replacement that gives users a separate inbox for encrypted messages. The system is built on Google's end-to-end encryption library, and the company has released E2EMail as an open-source project.
Wired quotes a web security researcher who calls the open sourcing "a telltale sign the project isn't going anywhere. This is a way for them to get their work out there but to absolve themselves of future obligations." But Google's privacy and security product manager responds that they're tackling some very thorny issues like secure key handling, and "The reason we want to put this into the open source community is precisely because everyone cares about this so much. We don't want everyone waiting for Google to get something done."
Wired quotes a web security researcher who calls the open sourcing "a telltale sign the project isn't going anywhere. This is a way for them to get their work out there but to absolve themselves of future obligations." But Google's privacy and security product manager responds that they're tackling some very thorny issues like secure key handling, and "The reason we want to put this into the open source community is precisely because everyone cares about this so much. We don't want everyone waiting for Google to get something done."
privacy (Score:1)
Let me count the problems... (Score:5, Insightful)
Having a plugin is nice, but it doesn't solve the PKI (key distribution and reputation) problem, and I am not very inclined to trust a plugin made by a company whose primary line of business is advertising by building user profiles.
Re: (Score:3, Insightful)
Having a plugin is nice, but it doesn't solve the PKI (key distribution and reputation) problem,
RTFA. They've provided a keyserver based on OAuth and a "trust on first use / warn on change" local cache. It solves the problem better than traditional PGP, albeit with less (nonfunctional) kool aid.
and I am not very inclined to trust a plugin made by a company whose primary line of business is advertising by building user profiles.
Then read the source, or expect others to do so and destroy Google's reputation if there are backdoors. The alternatives to the plugin are written by anyone who can send a pull request, ie. NSA. The fact that Google has some reputation to lose puts the situation above average, same as with Chrome. Either w
Re: (Score:2)
Having a plugin is nice, but it doesn't solve the PKI (key distribution and reputation) problem, and I am not very inclined to trust a plugin made by a company whose primary line of business is advertising by building user profiles.
What does PKI have to do with OpenPGP? Its fucking open source, why do you care who makes it if its open and you can see whether its spying on you?
Re: Let me count the problems... (Score:3)
Adam wants to send a message to Betty without anyone being able to snoop on it. Eve wants to snoop, for example by tricking Adam into thinking Eve's key belongs to Betty, or keeping Betty from reporting that get key changed due to a compromise. PKI is how you keep Eve from being able to fool with keys.
Re: (Score:2)
Thats not PKI. PKI is Public Key Infrastructure, as in certificate managers and issuers. You're point is juvenile and underlays your ignorance on the topic.
Re: (Score:2)
Wikipedia [wikipedia.org] agrees with me that a WoT is one form of PKI, and the published verification and trust statements that make up the WoT work as certificates of the associated public keys.
You have an unreasonably constrained view of what qualifies as a PKI. A PKI is merely something that helps users reliably identify the public keys that are used by particular other users. Google's system here does not solve the PKI problem because it really only associates the public keys with an account, not with the end user,
Re: (Score:1)
SMIME and DANE ? (Score:4, Insightful)
How about support for SMIME ?
It would be nice if they supported DANE so that all the keys where looked up automatically!
Why not ?
John
Re: SMIME and DANE ? (Score:3)
I long for the day that we can universally use DANE with SSL/TLS Certificates, and cut out the Certificate Authorities.
Lets get pragmatic here for a moment (Score:2, Offtopic)
I hate DRM as much as anyone but lets face it, if he did not ratify it into the standard, DRM isn't just gonna magically go away.
The only effect not ratifying it would actually have is to ensure the continued existence of a fragmented mess of multiple different actual implementations across different sites.
Re: (Score:2)
You replied to the wrong article.
Re: (Score:2)
Oops TY :-)
By now I should know better than to get on the computer before I get my first coffee.
Re: Stop the FUD already. (Score:2)
It's not hard to do PGP. It's only hard to do it properly, so that the Web of Trust works like it is supposed to.
Re: (Score:1)
> this stupid FUD that PGP/GPG is somehow "difficult" really gets on my nerves.
> With a functioning mail client it's not very difficult.
Well, there's the crux, ain't there, buddy. There is zero to none 'functioning email client' in that respect, as far as I see it!
Opportunistic encrption? Nope. Automatic key exchange? Nope. Hell...built-in functionality by default, nevermind it being turned on in the first place? Nope, nope, nope.
The MUA's are the primary reason, why PGP IS 'difficult' to use. Instead
Google? (Score:2)
Greetings from the alternate universe! (Score:5, Insightful)
People have been trying to find a replacement for PGP almost since the day it was released
I've been around since PGP first popularized public key email and while there have been various problems with Zimmerman's implementation from time to time (as with S/MIME since)... I do not recall any broad opposition to it or GnuPG... besides intelligence agencies who would be satisfied with nothing less than outlawing non-escrow encryption. We were in fact excited and intrigued by it, and it was fun to use even if you weren't paranoid. This must be a dispatch from the Millennial Alternate Universe where or any project emitted by Microsoft or promised by Google or announced in a press release is considered to be a vast improvement on what came before it.
End-To-End Encryption implemented solely in Javascript which is served up by the company that's not supposed to be spying on you is not worth the paper it's printed on. And Key Transparency is a fancy way of saying, use our single point of failure Internet Gizmo 'solution' to handle key management so you don't have to think about insurmountable issues of trust, as were directly addressed in Zimmerman's day (key signing parties, etc.).
Re: Greetings from the alternate universe! (Score:2)
Sure, if you ignore X.509 and all the other PKI standards [oasis-pki.org], no one has been trying to replace PGP's key distribution and verification schemes.
But when you look at what has actually been going on, is pretty clear that -- whether their reasons are good or bad -- lots of groups have rejected the PGP approach to public key crypto.
Re: (Score:2)
There is nothing ridiculous there. Key signing parties are the ONLY solution to the trust problem. Everything else compromises the idea through implicit (or unintended) centralized trust, misleading obfuscation or outright snake oil. The problem itself is ridiculous, not the only real solution.
Which of my public keys is the right one? The first one you see in an unencrypted email to you or DNS-steered web page? The one that comes to you armored within SSL or S/MIME signed through a CA chain to Symantec w
Re: (Score:3)
When Snowden wanted to initiate communication with Greenwald, would it really have been a good idea to use keys which were linked to their real names? And either way, using existing keys or newly minted ones, wouldn't they have to confirm the key fingerprints off-channel anyway? In that scenario, you really want to make sure you got the right one.
For other types of communication, the threat model is different: When I send a message to my family, the content of the message is probably enough to establish tha
PGP does n scale (Score:1)
If they intend on dropping it, at least its open (Score:1)