Slashdot Mirror
Encrypt and Sign Gmail messages with FireGPG
Linux.com (Same owners as Slashdot) has a story up about FireGPG and says "Gmail may be an excellent Web-based email application, but there is no easy way to use it with privacy tools like GnuPG. The FireGPG extension for Firefox is designed to solve this problem. It integrates nicely into Gmail's interface and allows you...
Encrypt and sign Gmail messages with FireGPG
Encrypt and sign Gmail messages with FireGPG
Note that OTR is "better". From the OTR site:
How is this different from the gaim-encryption plugin?
The gaim-encryption plugin provides encryption and authentication, but not deniability or perfect forward secrecy. If an attacker or a virus gets access to your machine, all of your past gaim-encryption conversations are retroactively compromised. Further, since all of the messages are digitally signed, there is difficult-to-deny proof that you said what you did: not what we want for a supposedly private conversation!
It is just that I don't want anybody to intrude my privacy. Do you close the envelope of a regular snail-mail letter? If so, do YOU have something to hide??
This extension seems very cool, and I plan to try it out when I get home. When I first read the summary I thought to myself, "A firefox extension and gmail, how much simpler could it get!" But, unfortunately this is not point & click encryption. It requires an additional external program (GnuPG) to function. Even this small, relatively trivial step is too much for beginning to average computer users. Encrypted email is great and all, but I can only send it to other people with encryption-enabled email clients.
Where is the it-just-works email encrytion for dummies?
I welcome our new 99% overlords.
I'm more concerned about the letter (or worse, a check) falling out.
I generally close the envelope of snail mail so the mail doesn't fall out.
I use security envelopes to obscure the contents of my mail. You probably would want to use that as an analogy instead.
So... you are saying that the NSA has the ability and desire to break every ElGamel 2048-bit length encrypted message it captures with Echelon? I've seen too much of government from the inside to think that any agency operates as well as the NSA FUD would have us believe. Especially when you realize it is far easier and cheaper to make your enemies believe you have super powers than it is to actually develop those super powers, completely in-house with no outside knowledge or help.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
So if you "always" sign your messages, then you can tell off anyone you want as long as you don't sign it. Brilliant!
This is what standards are for. We need a standard for IM encryption, possibly as part of a larger encryption framework. I have no problem advocating a standard, which I think is a lot better idea than advocating a given program/library.
If only some of the other IM clients would start building it in by default, rather than making it an optional addon, I think it would quickly gain traction as a de facto standard.OTR is licensed as GPL/LGPL. As such, I'm not sure a lot of major software makers will be all that keen about implementing it. Take a look at iChat or Yahoo Messenger. They're not going to open source their application just to add an encryption format that is still pretty rare and where there is not a lot of demand. This is one of those rare instances where a BSD licensed implementation would be a whole lot more likely to solidify the de-facto standard. Realistically, I doubt that the major players are going to go open source for their clients, and as such I doubt there will be adoption of OTR unless it is submitted as a real, well documented standard and/or a BSD reference implementation is made available. We're a lot more likely to see Microsoft or AOL take over this space with a proprietary encryption scheme, which will be reverse engineered and pseudo-supported on other platforms/clients simply because people will need to communicate with the majority.
FireGPG is great, I suppose, but doesn't help those of us who only use GMail via POP3/SMTP, both to avoid advertising and have mail archives under our own direct control.
In fact, FireGPG actually benefits Google and its advertising goals, since it only functions via Firefox and Google's ad-infested Web interface.
Here is why you don't do that: Because why wouldn't a terrorist leave corroborating evidence lying around proving it was all just a test to psych the government out, so they can be let go? While they are interviewing your "third parties" you are being beaten half to death, electrocuted, water boarded, and raped. IF, and its a huge, colossally massive if, they ever EVER believe you that you were just kidding about bombing NY with a dirty bomb, they will testify that you cannot be released since after your brutal torture you probably are now a terrorist even through you weren't before. Plus you can't exactly be let go since the torture techniques are classified information and you might leak them. Just like Jose Padilla. First he HAD a dirty bomb, then he was building one, then he was thinking about it, then he knew somebody who was thinking about it, then nothing...but they have ruled he can NEVER face trial, and can NEVER be released. Their reasoning is their "interrogation techniques" have irreversibly damaged him mentally, so he's too unstable to stand trial. But these "interrogation techniques" are highly classified matters of national security, so he can never ever be allowed to talk to anybody in case he tells them what they did to him (especially not a lawyer). And that would be you. Now remember, he _WAS_ a citizen, and there was no evidence against him. Still tortured and given a life sentence without the possibility of a trial. What fucking chance do you think you have if there IS evidence against you? Well you might have white skin so you just may have some kind of chance.
ASCII stupid question, get a stupid ANSI
Methinks thou dost protest too much. In other words, you may want to calm down a bit, you're sounding a little anxious (or jealous?).
http://xkcd.com/c177.html
As always, XKCD is so relevent, it's not even funny, except it is, and so are chair dancing on the heads of penguins.
// file: mice.h
#include "frickin_lasers.h"
Man, I miss the days when a post like that would have made me laugh and I would have called you a loon...
Ignore anything I said above, I actually agree with everything you believe - mod accordingly.
then just write the address and add the stamp on the letter/cheque itself, don't bother with the envelope. You can saves trees at the same time!
Well, you want to make sure it IS from the person you think it is, but, that doesn't mean you have to know who the person IS in real life.
It would be cool if these email plugins would help make it easy to register and use the nym servers. This way you could set up an email address on each end. PGP sigs can be used, but, there is plausible denyability as to who really is at each end of the email.
Of course if you're really worried about tracability, then set up a nym account to send out on, but, on return messages...just have it post encrypted to one of many USENET groups. You then really have a disconnect 'cause there's no good way to monitor around the world who gets what messages of USENET.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
They use programs to determine who is using high level encryption. Afterwards, they plant a keylogger with burst transmitter in your keyboard. By doing it that way, they don't have to spend anytime decrypting. You can any program or level of encryption you want and it won't do any good since you are compromised at a lower level.
Source?