Slashdot Mirror

The problem is that end-to-end encryption is basically incompatible with webmail. You need to provide your encryption keys to the mail client and if that client is running code provided by a third party that communicates with a third party server then you've lost already.

I give you Mailvelope and FireGPG.

It sounds like you want FireGPG or Mailvelope. Too bad the first one is discontinued and the second one is not ready for Firefox yet, just Chrome. Is there a widely used browser plugin I missed?

What is wrong with http://getfiregpg.org/s/home

http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/

http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/

It would be interesting if a semi-rogue group like this implemented a virus that would propagate and install browser plugins like (defunct) firegpg (and similar for email clients, depending on what the user uses), generate keypairs, and submit them to a central key authority, and then just start encrypting peoples' emails for them. True to do it transparently, the keys would have to be stored clear on the users' computer, but even still, it would be a huge boost in privacy.

You haven't checked out the firegpg page in awhile. Development has been discontinued and Gmail support has been removed.

I suppose in theory you could always issue all your friends webmail accounts, hosted on your server, hosting your domain. A better question might be, "does this apply only to email, or all electronic communications?" If it ONLY applies to email, your 4th ammendment rights could still be upheld by using say, private messages (PMs) on an internet forum, or any number of alternative "email" systems.

Does Gmail have native PGP support yet? Is there a Chrome plugin for that?

For Firefox, there's the FireGPG plugin that supports Gmail and a few other webmail interfaces.

Once you have PGP encryption/decryption in the browser, it would be nice if mail hosting companies offered the option to encrypt unencrypted mail as it arrives.

I suppose in theory you could always issue all your friends webmail accounts, hosted on your server, hosting your domain. A better question might be, "does this apply only to email, or all electronic communications?" If it ONLY applies to email, your 4th ammendment rights could still be upheld by using say, private messages (PMs) on an internet forum, or any number of alternative "email" systems.

Does Gmail have native PGP support yet? Is there a Chrome plugin for that?

For Firefox, there's the FireGPG plugin that supports Gmail and a few other webmail interfaces.

Once you have PGP encryption/decryption in the browser, it would be nice if mail hosting companies offered the option to encrypt unencrypted mail as it arrives.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This is why the use of encryption is a must. Sending email is like sending a postcard, except that copies of it are made and stored for perusal by government officials and ISP employees. Since most people use Firefox they should check out the amazing http://getfiregpg.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Use GnuPG with Firefox : http://getfiregpg.org/ (Version: 0.7.10)

iF4EAREIAAYFAkufikAACgkQmu9IBuIu3yEYOgD/dDFE5oEieIS9PWP7dUm+rOXU
1yfiGTlXropncPeFhX0BAIaYlc1iecFMV3CE2G2w7zZXO7pNlWEVqHS0yD9J2Z3j
=HF92
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This is why the use of encryption is a must. Sending email is like sending a postcard, except that copies of it are made and stored for perusal by government officials and ISP employees. Since most people use Firefox they should check out the amazing http://getfiregpg.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Use GnuPG with Firefox : http://getfiregpg.org/ (Version: 0.7.10)

iF4EAREIAAYFAkufikAACgkQmu9IBuIu3yEYOgD/dDFE5oEieIS9PWP7dUm+rOXU
1yfiGTlXropncPeFhX0BAIaYlc1iecFMV3CE2G2w7zZXO7pNlWEVqHS0yD9J2Z3j
=HF92
-----END PGP SIGNATURE-----

Your ISP also "reads" your mails. If you want to make sure nobody will read a mail save it's recipient, then use encryption. FireGPG works great on Gmail.

That is: if anyone figures out a way to combine end-to-end encryption with web based e-mail (popular as it is).

I take it you are not familiar with the FireGPG browser extension. I can encrypt text, decrypt text and verify signatures on any website with a couple of clicks. There is Gmail integration too.

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.11 (GNU/Linux)
Comment: Use GnuPG with Firefox : http://getfiregpg.org/ (Version: 0.7.8)

jA0ECQMCsKcP6wfPDoxg0loBWWLKcbIxLwk35Vu8Lu6+Fldnq64aqGPosMh/h1r8
IB3uDEi+UAc8JgDqZYL18qYLzQazbRDz4MZySZg/CRKf7R13UWWqbHr8fCPyyEcI
RiIXV6Qgw/US76w=
=ZYx8
-----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCkTas05nmkylgycBlXKaIERjQoswkNtzRL2hM6u/xz2B/2HZP1xUHl/sM fcgDDQbVbdpzllBq2yAq6/m59BkgsSSpXIDMhVXx+a+H6Loi0MY03Pz/9+XwiN9a veods6E+3a7Z7UC20PB+w6rbj5iYnKI9mK46Kfm+j05BI4brLlGTytI3O/Ziqh9b 1kVYXtSOMa8OQHjK515tVr9aZ/sVCCwkwSRzzo430Ok3/0tis2FYDMcM4UZh4hz8 2JBOktnKzuB7so5c03OQBn2PcLHBSZw+R7RUGfbeo4cIYhp/+fEzYmZTctbEXuVq TU55MebWTne3UaBRLFtwogKk1ekkPTC3MoAtcwnSqQ4R5S9ofU3+pDZrYKwnkMTW bHDnuehWHD3cQUF5Zs2wrA8avlT9u4c= =7/hg -----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCFSb7W7Ire/dgycAI05l10ksK/fxGuBevK71MRWqZL7DZrkyjmZw8A+vr RPLvc2s4LLoB05mTQ501UG6d4uA/gIVNaB95KEuuYS3ECePslSvc3VRUV9xOGPXV nltykNBzwLp0cT+43oFbQCTa+cWIP6EokhAEy8k/xaycPQR/yVT+0kypVuL0D5n7 M1VTZ+nQD/W0OTtkValHYUNCSHCS4ElwvX4AJudTm4J2V9lY1eFV0hg7rj/uL0Cx jG9os/KEhZwrpTAkO3iTYWztNfQVpP4VJQ0= =4XSE -----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCtMhSBLtolrVgyYx5umQf79GsFeYxMKyf2DGhKfoqmokO+HMayeEEVYSc C7nDy+OdHnxseY6OR640f2hSUhuRAMoaO1FQEenKBUVIMBJajxDRCO17O4jpiHt2 Nzf4/ebX6M96UrPdVYH2+8wCLgXua8+6vUsA2edTkk3COyei1gC4b+RjF6qWos4q 2K6vG3KtmHvEiAdAEQ== =SJvi -----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.9 (MingW32) Comment: http://getfiregpg.org/ jA0EAwMCWjpda1NtCPlgyXXCEakX5NETxlcrpXmMNjvJh99WUVCSn6BnsYcB4RJe fZlYT/E4vkzxsoDU8U5cgpUoa6GKPxnXmI2sg2mtKO9ZSG1SIYhEry4OHJ2lv6pI RUX4ywYMCnsgZDu2Ot7sBimrzJ4jLgCVskGnEVGJPP0BRDY+//E= =hBrX -----END PGP MESSAGE----- the Lameness sucks the life right outa pgp

This is not to be decrypted by anyone in the RIAA or MPAA. -----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCN3Q5S5K8/stgyW2wpPDp9qolaWLUSeezFjx/U4Qis37YdJcWPiIPC13E DUQfb+94qzZxK7PEWU+GdCUHmCeVf9W1tCsR43HTl1VJKLSIHGwEhcNMT3YQhVSA vt3AIvLVDoMnUff9muZKGdTtVZWzE0/i6BWCgms2 =AUh8 -----END PGP MESSAGE----- This FireGPG plugin is nice!
Hang on - wait - how is this "browser plugin" running programs (gpg) on our local machines?

-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCekgVsNWaUAhgycAQNns+bnnRYqFALRaoj2B58/31fABkwz7Ty3BRmNo4 KMkK0H3Qshfr05XmUoBzEn+704yWsOxzE+O/gLy/ecaA1V6V9UyaP2Xk6nSjKjdE 7XKo5AGzEOWLXzXS/Axco+vxq/7kaJ02J+vCMhZ9QrY1z+6KDs1MRO4Vw7TjS8VB YBICxbGWzjLXtY5Iun7unPU73R6SHeJqOo3wJ/JpK/OK2B5rsrvySTe/8EfCSZIT mEJSzeZY+lRIOGBxI3E6ZLLWB7hVnP7laIxsX+UcRo9cSw== =tozK -----END PGP MESSAGE-----

Copyright 2008 morgan_greywolf. All rights reserved.

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://getfiregpg.org/

jA0EAwMCq1d6DSlcTFBgyVbFIH21I4WaaMdk4LmIAkeqVumRhZuEShoxFVAJY/qn
VRuvT7O9xzq2ZUY4MJj2I9oBEgyfp4A8IOibt7UKCBu8rTsLt9PWHOFMJFTyqNNX
+MrnvNxDmA==
=ztJ+
-----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: http://getfiregpg.org/

jA0EAwMCuBk5bDLsjOVgyVRczylkXHQOoLrTZ4feTOyTgnhGn5NxdGTKQJiXOzt/
HsEG6/73TJGgkRzARmFdOCSIBd/w4+UCrF7zefX031zqAurOsYcLN+mF9ft6UBM1
O9tjvqs=
=Jmbx
-----END PGP MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: http://getfiregpg.org/ jA0EAgMCE1WFx3s1GhVgyXuFr5t3x71hUluDyhuwZZ9kj1HINOj02aUvQW8iHjfv fF+itWhuHnSC7hT0yQsvZMlcVwDx4030e/Ln3YmMUgyiXLLZGXK0GWAjLO46mbqN nkI6SfXwAhZxzsi3EyFkNBoJF9Tacr/FCEt2ctA9fFsq9VY+RF5LSKXERz0= =FNJz -----END PGP MESSAGE-----

Firefox + Gmail + http://getfiregpg.org/ = An excellent, private email service.

I wonder how difficult it would be to come up with a "mod_gpg" or something of the sort that would work in tandem with FireGPG or something similar. That might get around both Mozilla's new anti-self-serve-SSL campaign, plus technical problems like virtual hosts on the same IP address...

http://www.gnupg.org/ - The GNU Privacy Guard

http://getfiregpg.org/ - FireGPG, "encrypt, decrypt, sign or verify the signature of text in any web page using GnuPG" (untested by me).
https://addons.mozilla.org/en-US/firefox/addon/3424 - another Firefox extension, also untested.
https://addons.mozilla.org/en-US/firefox/addon/3208 - another one that may be useful (untested).

http://www.gpg4win.org/ - something for MS Windows

Remember folks, even if you aren't in the UK, this still affects you! If you communicate with people in the UK, if you have email based in the UK (I have a Yahoo.co.uk email address, in addition to my 50 other email addresses...), etc. ...

It is as simple as installing Firefox, installing GNUPG, and installing that extension that lets you encrypt text fields when you are emailing...

And don't forget TrueCrypt http://truecrypt.org/ though it isn't strictly relevant in this case, it is always relevant.

Generally yes, but Hushmail offered two methods of encrypting emails: on their servers and in a Java applet that did it locally.

The problem is that the applet can't be verified. And, honestly, this should never have been the first indication of that.

Or rather, the applet could be verified -- you'd just have to verify it every time. The only way I know of to make this easy would be with a Firefox extension -- but at that point, to borrow the other poster's idea, why use Hushmail in the first place?

Hushmail is really a way of making GPG easy for people who don't understand how it works. The flaw in this is that to use GPG at all securely, you need to have a fair understanding of how it works.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

After reading more about the story the young man indeed seems to have gotten himself into hot water. But let's ask ourselves who was harmed by his actions and how will putting him away for 38 years actually help anybody? The largest part of all this is the government arbitrarily saying you can't do something and then penalizing when the rule is broken.

Just wait and see. The criminal federal government will make a pea bargain to reduce his sentence if he will help them to hack into citizen's computers to supposedly help with "national intelligence".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://getfiregpg.org/

iD8DBQFIXWh17J1dPd3sAmARAlseAJ9yM7H/I88Kaq0WDqXAJu+uNJaAxgCfTN6Q
qtUrRZnYvPo3S7OyPGsdwFw=
=sgYd
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The criminals are the software engineers, Teachers and IT Administrators and school board members who are not adhering to proper security practices. Students are in school to learn, to be curious, to test the boundaries.

Hey, I am running for a seat in the US House of Representatives in Wisconsin's South East District:
http://www.josephwilliambaker.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://getfiregpg.org/

iD8DBQFIXV727J1dPd3sAmARAvxXAKC2W53AQ1dBDHGulNI47dalJbqjrQCgk+hr
bgPmfJsfR0f3JO50J/rJ6tw=
=2awL
-----END PGP SIGNATURE-----

There is a great addon to Firefox, FireGPG which adds new buttons to gmail like Sign, Encrypt, Sign+Encrypt.

It also decrypts and verifies incoming mails.

Here you go.