Slashdot Mirror
Encrypt and Sign Gmail messages with FireGPG
Linux.com (Same owners as Slashdot) has a story up about FireGPG and says "Gmail may be an excellent Web-based email application, but there is no easy way to use it with privacy tools like GnuPG. The FireGPG extension for Firefox is designed to solve this problem. It integrates nicely into Gmail's interface and allows you...
Encrypt and sign Gmail messages with FireGPG
Encrypt and sign Gmail messages with FireGPG
I don't understand this fascination with encryption. Why do people use it. Is it because you're hiding something illegal? It's kiddie porn isn't it? Be honest!
For me, I just like to use it, to make people think I am doing something.
Keeps the snoops on their toes.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I thought their business model worked on the idea that they could datamine all your email and (among other things) offer you targeted email based on the content therein... this'll screw with that idea...
"BUY jjhHDJEy6786ERLKLXhdfeprERIOUPewoenOIhgshgrgeyrew now for a low price on Ebay.co.uk"
-----BEGIN PGP MESSAGE-----8 f7hh4839h47f7e8 394g84953jgf84g erniguiregt980
Version: GNUPG v0.4.0 (GNU/Linux)
Comment: Wonderful
ewurnfi3u834j9few4jf9oewfqvi7y&H*&HAwr8hw78er7hfw
wf8943f89jw3r8j9fesajaejro5gvl;rhyklyfp[ult0h43jg
fnw98efj89324rtuerjgeiorgtjerilgtjireogniregunren
werj
-----END PGP MESSAGE-----
I have nothing more to add
liqbase
I thought, their ability to automatically parse the messages — so as to show users the relevant advertisements, was the reason, I am getting an unlimited mailbox with nice interface for free.
If all/most of my messages are encrypted, how will they know, what to peddle to me? Can't do much on Subjects alone... Or can they?
In Soviet Washington the swamp drains you.
I use the pop3 support in gmail and have Thunderbird handle everything (via enigmail extension). Also works with Kmail (which integrates spamassassin and clamav nicely). Besides, I usually use Konqueror or Lynx.
FireGPG still has issues with signed messages via GMail at the moment -- GMail's formatter likes to strip off or replace certain types of whitespace, regardless of if you're in plaintext or HTML mode; the authors know about it and there are several threads on their forums relating to this issue, but it doesn't look like there's an easy fix for it.
This extension seems very cool, and I plan to try it out when I get home. When I first read the summary I thought to myself, "A firefox extension and gmail, how much simpler could it get!" But, unfortunately this is not point & click encryption. It requires an additional external program (GnuPG) to function. Even this small, relatively trivial step is too much for beginning to average computer users. Encrypted email is great and all, but I can only send it to other people with encryption-enabled email clients.
Where is the it-just-works email encrytion for dummies?
I welcome our new 99% overlords.
OTR is miles better than the gaim-encryption/pidgin-encrypt. Honestly, I don't understand why they won't just kill it and move to OTR for good; it's a fundamentally better security model for something transient like instant messages.
Particularly since having two mutually-incompatible encryption packages is a pretty crummy state of affairs; it just means that the few users who do use encryption, are going to be fragmented between incompatible systems.
OTR probably has the greatest market penetration of any IM-encryption system, outside of corporate clients (Sametime, I think, uses encryption by default, although I don't think it's end-to-end, only client-server, because there they want the ability to intercept on the server), because it's built into the fairly popular OS X Adium client. So there's already quite a few users out there who have software that supports it. If only some of the other IM clients would start building it in by default, rather than making it an optional addon, I think it would quickly gain traction as a de facto standard. (And that would be a good thing, since it's a good system and open source.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Where are the editors? It looks like firehose-type blurbs are starting to make it to the front page...
Oh wait, it's CmdrTaco. Never mind.
in my travels i can across this javascript-based RSA cryptography demo. if you want to use it, hit Generate, then send the first two numbers (Modulus and Public Exponent) to whoever you want to talk to. they have to do the same. you enter their modulus and exponent into another window to encrypt.
the code is BSD-licensed. i've been meaning to write a larger javascript app to hold your keys and everyone elses' in a single window, and with a click of a button create a block of XML that you can copy+paste to a file to store the keys, but i havent got around to it.
You know you can use POP and SMTP with Gmail? GPG and S/MIME work just fine as far as I've found.
Deleted
I've been using the S/MIME plugin for Firefox. and it's great. I'm not sure I like the way you have to apply for a certificate from Thawte, but it works and it's very painless.
This is not painless and easy, and IMHO S/MIME is alot nicer implemented than PGP signatures.
While the site says only Gmail is supported, could this be made to work with other web apps? It'd be neat to have something like this for webmail on my own domains, forum-based messages, and so on.
Slashdot Burying Stories About Slashdot Media Owned
I haven't used gmail that much, but I was under the impression that it saved drafts of what's in the composition textbox at intervals.
That data would be all cleartext wouldn't it? Seems a tad risky to me.
This is not painless and easy, and IMHO S/MIME is alot nicer implemented than PGP signatures.
S/MIME is oftentimes more slickly implemented, because it tends to get more use on the corporate side, but I think that it's unsuited for wide use because of its reliance on centralized certificate authorities. The whole certificate-based infrastructure isn't anything that most people want to have to deal with.
For 90% of all communications, what people want is an email (or IM, or whatever) version of PGPfone -- they just want the data secured in transit, with the actual user authentication done via some side-channel (calling them up on the phone and exchanging key fingerprints, etc.).
If people have to get and install certificates, they're not going to use the system.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Perhaps I should explain abit more, the GPG plugin has problems with GMail wordwrap, and correctly verifying signatures of emails received by gmail.
But it works wonderfully to sign short messages, but nothing more complicated.
It took quite sometime for the S/MIME extension to mature enough to be usable, so this may work in a couple of months..
Hey, your girlfriend called. She said she couldn't read the garbled message you sent. However, I passed on your "wanna...tonight" message to her and she said "yes" but I don't think your name came up. So...if you don't mind, I'd like to get out a little early tonight...
s/mime is great and simple. This is what geeks should be pushing onto their friends not gpg. Most mail clients support it. The worst of it is that you need to make a cert. That requires some hand holding, but it sure beats endless hand-holding with gpg or old pgp installs.
I wonder what Adsense will make of this?
Silence is golden... and duct tape is silver.
FireGPG is great, I suppose, but doesn't help those of us who only use GMail via POP3/SMTP, both to avoid advertising and have mail archives under our own direct control.
In fact, FireGPG actually benefits Google and its advertising goals, since it only functions via Firefox and Google's ad-infested Web interface.
Does that plugin actually support signatures yet? Encryption is great and all, but has way less useful security properties without signatures.
-- The act of censorship is always worse than whatever is being censored. Always.
an3 oTher party
Ah yes, Ron Paul. The right wing's answer to Ralph Nader. I sincerely hope he wins the Republican primary, because that'd make the Dems unbeatable in 2008. Even Kucinich would be a shoo-in against that weirdo.
The overprivileged adolescents who buy into libertarianism may fall for Mr. Paul's song and dance, true, but fortunately they can't vote.
Or you could just use hushmail.com and not worry about all the other pieces.
Bigtime Consulting - "We're the best because we cost the most"
Google just does too darn much. One option might be to use it in 'basic HTML' view. Another is to compose your messages in a text editor then cut and paste (but quickly!) when you are ready to send.. :/
In Web 4.0 the browser will watch you through your monitor and shout ads at you when you are at your desk.
One thing that is CERTAINLY true is that most email users have zero interest in maintaining a web of trust. That means PGP is right out.
S/MIME relies on people trusting third party certificate authorities and acquiring the certificates of other in order to send encrypted messages. This actually COULD work if the major email vendors agree to cooperate on some sort of certificate distribution method, and provide an easy way for people to get keypairs in the first place. This is at least possible.
Something with WEAK authentication, like PGPfone, is STILL going to require extra work on the end user's part, but does not depend on large companies cooperating. It's nice, but I just can't see this happening because, instead, it relies on an enormous group of non-technical people cooperating.
Email encryption will come eventually, but it will probably be in the form of S/MIME and be pushed by the likes of Google and Yahoo. There is no other way that is even remotely feasible.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
I understand that in some countries, you are legally compelled to provide the keys to access files encrypted with PGP, GPG, etc. if the authorities demand access. If you refuse to produce a working key, or claim to be unable to do so, a judge is able to assume that you are deliberately hiding something.
Firstly, I wondered if anyone could confirm this? I have heard that it is the case for Britain at least, although I don't see how it can possibly be legally compatible with the presumption of innocence.
Secondly, I wanted to suggest that perhaps this is a reason not to use PGP, because PGP encrypted information can always be decrypted using the recipient's key - even many years after the message was originally sent. So law enforcement officers will be able to get old PGP-encrypted documents from your email account (probably even if you delete them, thanks to backup tapes). They'll then be able to force you to decrypt them, and if you don't, they can assume you are witholding the key because the files are full of terrorist plans or whatever.
I suggest that people should only use cryptosystems where the session keys are destroyed immediately after use, such as SSH and (possibly) some secure instant messaging services. Even if law enforcement officers use a wiretap to record everything sent by you over an SSH connection, and then seize your computers, they still can't recover the plaintext because the session keys have already been deleted. It's impossible for you, the suspect, to produce the keys, which should help your legal defense. Here's a way to chat securely by SSH.. if you need to transfer files, you can use SFTP.
>north
You're an immobile computer, remember?
I've been using Freenigma (http://www.freenigma.com) way before I even heard of FireGPG, and they've had a Firefox extension since then too.
May contain traces of nut.
Made from the freshest electrons.
Not only that but S/MIME is an official standardized and widely recognized system whereas PGP/GPG is proprietary incompatible garbage that some guy invented.
"hey wanna fuck tonight?" and i'm not particularly keen on the network guys reading that.
Network guys need luvin' too!
When I did last-minute taxes for a family member, and one of us didn't have a fax machine, the easiest thing to do was scan the W2s etc. and email them.
One thing that is CERTAINLY true is that most email users have zero interest in maintaining a web of trust. That means PGP is right out.
You don't really need the web of trust for PGP. You can use it without any of that quite easily. You grab the keys from a keyserver, and then if you're paranoid or worried about MITM attacks, you verify the fingerprint with the recipient through a side-channel (voice phone, whatever). It's just like PGPfone.
Unfortunately, PGP and the 'web of trust' are often conflated, but you can have webs of trust in a S/MIME model (Thawte's free certificates are like this), and you can do centralized authentication in PGP.
Honestly, I think that fans of PGP need to stop pushing the WoT model, because it's too cumbersome for normal users, who really only want about the same level of security offered by landline phones. It's available, for people who want to participate in it, but it's not an essential feature for most users.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Freenigma is adding GPG encryption to Gmail and several other webmails since last summer! If you are interested in Freenigma read my interview with its main developer Stefan Richter on the Clipperz password manager blog.
Thanks, most informative!
The --show-session-key option looks handy - but in a way, this illustrates the second point I was getting at, which is that information encrypted with GPG can be recovered as long as any recipient can be forced to give up his private key (or run --show-session-key). This is something that any GPG user should bear in mind, particularly as GPG ciphertext will sit in email boxes for many years. You're trusting the recipient to keep his key secret forever: you trust him now and in the future. Whereas if your ciphertext becomes useless shortly after it is sent, you only have to trust the recipient in the present.
>north
You're an immobile computer, remember?
now we sign our mails. google stores it for ages. now who could use such kind of information..
You would think that adding GPG would be a next logical feature for Google to add...well, anything that will get my mom to use GPG will make me smile.
"...What is good for General Motors is good for America." -Charles Wilson, Secretary of Defense and fmr President of GM
There is just no way that could reach widespread adoption. Only a PKI model, backed by major mail providers, could have a chance. My mom will never understand fingerprinting. She could understand "This message is signed by John Doe!*" showing up in her mail client, where the asterisk means, "according to Verisign, who is trusted by Gmail."
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Not only that but S/MIME is an official standardized and widely recognized system whereas PGP/GPG is proprietary incompatible garbage that some guy invented.
http://www.ietf.org/rfc/rfc2440.txt
Because it's really important for people who post on slash dot (or anywhere else for that matter) to encrypt all of their highly sensitive discussions about Michael Moore, Global Warming, Ninjas, Pirates and I guess... if it's Dugg - Paris Hilton, if it's You Tube - it'll be a man nailing his penis to a block of wood or catching it in a mousetrap, and - I mustn't forget my last and extremely important comment about Ponder Stibbons here recently. I just so wish I had encrypted that.
I do have GNUpgp (the German version) on Funderburd but I haven't used it. I am saving it for when all that Terminator type Sith starts happening, cos then we'll definitely need it. We'll also need those cool GSD's that can sniff those skins jobs and I will have to try and remember what it was that Micheal Biehn made out of corn syrup and mothballs and more importantly -why? Oh wait a minute, we won't be able to use the Net will we? That will belong to the bots. D'oh!
Hang on a minute... did I just include some hidden message in the text or is just another sad example of the influence of Post-Modernism?
Posts, MyBio or Sig, may contain satire, sarcasm, bolded nouns be sardonic or even witty & be Church of SD
I haven't tried this out yet, but it looks promising. Lack of client-side crypto has been one of my main objections to webmail.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
They use programs to determine who is using high level encryption. Afterwards, they plant a keylogger with burst transmitter in your keyboard. By doing it that way, they don't have to spend anytime decrypting. You can any program or level of encryption you want and it won't do any good since you are compromised at a lower level.
No text
"Democracy is two wolves and a lamb voting on what to have for lunch. Liberty is a well-armed lamb contesting the vote."
> Honestly, I think that fans of PGP need to stop pushing the WoT model,
> because it's too cumbersome for normal users, who really only want
> about the same level of security offered by landline phones.
> It's available, for people who want to participate in it,
> but it's not an essential feature for most users.
Thank you! I couldn't agree more. So far it's always been: "Crypto is secure, but only if authenticated. If no authentication, crypto is not secure, therefore better no encryption at all!". I think, that's about as nonsensical as it can get. While I do agree with the security concept of authenticated cryptography, in the real world things could be done in several ways, as the parent points out correctly.
For example: With GPG being on the machine, an E-Mail program like Thunderbird could easily create a key pair for its own use and send the public key along with either every e-mail message (in the headers) or at least once on initial use of a unique e-mail address. The recipients Thunderbird does the same and now the communication between the two users could be encrypted *completely in the background* with no user intervention required. Yes, it is open to a MITM attack, but I don't care, because it's extremely unlikely, that every e-mail gets their keys swapped out in real-time. Even if...so what? It goes out *in the clear* otherwise ANYWAY.
In addition to this mode, a more consciously chosen "secure/authenticated encryption" mode could be used, which is basically what we have now with Thunderbird/Enigmail/GPG + active user setup and control. These two modes of unauthenticated background encryption and user-visible authentication/encryption could and should co-exist in the same E-Mail client and I truly believe, it would be easily implementable. The net effect would be an exponential increase in encrypted e-mail messages flying over the Internet. A good thing!
So...can somebody program this into Thunderbird?
One of gmail's big features is that it scans your emails and delivers targeted ads to you. They also have this pretty nifty search engine thing going on. That's pretty much why gmail exists.
an encryption feature goes against their whole mission as an email provider. I don't see them ever embracing encryption.
Thanks to the autosave feature, Google will still get the text of your message as you type it in.
Dinomite.net
Why bother with the identification layer at all, for people like your mom?
Just say "This message was signed by jdoe@jdoecorp.com". Does that mean it was signed by John Doe? Maybe. Maybe it was his secretary. Who knows; but it was signed by someone using his email address (that's easy enough to verify). That doesn't require PKI or WoT.
Centralized PKI is at least as problematic as webs of trust, probably more. Nobody's been able to do it well, and a lot of time and money has been spent trying to get it to work. It makes email and communication in general expensive. It creates single points of failure. It creates avenues for corruption (both of data/keys and money). And very few people need what it offers, except when they're conducting financial transactions.
Most users don't need rigorous authentication. All they need is channel encryption, with some modicum of security against MITM, and even then, the latter is only for hardcore paranoids.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Any more sensationalist disinformation you'd like to share?
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock