Encrypt and Sign Gmail messages with FireGPG

Linux.com (Same owners as Slashdot) has a story up about FireGPG and says "Gmail may be an excellent Web-based email application, but there is no easy way to use it with privacy tools like GnuPG. The FireGPG extension for Firefox is designed to solve this problem. It integrates nicely into Gmail's interface and allows you...
Encrypt and sign Gmail messages with FireGPG

Comments

The Fascination with Encryption

[Ian McBeth]

For me, I just like to use it, to make people think I am doing something.
Keeps the snoops on their toes.

Re:The Fascination with Encryption

[Bromskloss]

For me, I just like to use it, to make people think I am doing something. Keeps the snoops on their toes.

I keep them on their toes by acting completely normal, having them looking for steganography.

Re:The Fascination with Encryption

[jimstapleton]

I only use one-time use pads when sending my emails. It keeps them busy and unable to decrypt the emails!

Re:The Fascination with Encryption

[Bromskloss]

Well, have you found the hidden message in the parent post yet?

Re:The Fascination with Encryption

[u8i9o0]

I keep them on their toes by acting completely normal, having them looking for steganography.

Well, have you found the hidden message in the parent post yet?

Sorry, there is no hidden message.
1. You noted that you use encryption when acting normal.
2. However, you were posting on /. which has been established (quite conclusively) as abnormal behavior.
3. Since you were not "acting completely normal", it is obvious that you were not employing any encryption scheme.
4. :)
5. Profit!

Re:The Fascination with Encryption

[canajin56]

Here is why you don't do that: Because why wouldn't a terrorist leave corroborating evidence lying around proving it was all just a test to psych the government out, so they can be let go? While they are interviewing your "third parties" you are being beaten half to death, electrocuted, water boarded, and raped. IF, and its a huge, colossally massive if, they ever EVER believe you that you were just kidding about bombing NY with a dirty bomb, they will testify that you cannot be released since after your brutal torture you probably are now a terrorist even through you weren't before. Plus you can't exactly be let go since the torture techniques are classified information and you might leak them. Just like Jose Padilla. First he HAD a dirty bomb, then he was building one, then he was thinking about it, then he knew somebody who was thinking about it, then nothing...but they have ruled he can NEVER face trial, and can NEVER be released. Their reasoning is their "interrogation techniques" have irreversibly damaged him mentally, so he's too unstable to stand trial. But these "interrogation techniques" are highly classified matters of national security, so he can never ever be allowed to talk to anybody in case he tells them what they did to him (especially not a lawyer). And that would be you. Now remember, he _WAS_ a citizen, and there was no evidence against him. Still tortured and given a life sentence without the possibility of a trial. What fucking chance do you think you have if there IS evidence against you? Well you might have white skin so you just may have some kind of chance.

Re:The Fascination with Encryption

[MyOtherUIDis3digits]

Man, I miss the days when a post like that would have made me laugh and I would have called you a loon...

Re:The Fascination with Encryption

[Warg! The Orcs!!]

My wife uses one-time pads but I wouldn't send them in the mail.

And for the chat

[DrYak]

And if want PGP encryption for chat (Gmail's associated GTalk or any other protocol like MSN, etc.) there is Pidgin (formely Gaim) with plugins :

• Etiher Pidgin Encrypt (formely Gaim Encryption)
• Or OTR

Re:And for the chat

[stinerman]

Note that OTR is "better". From the OTR site:

How is this different from the gaim-encryption plugin?
        The gaim-encryption plugin provides encryption and authentication, but not deniability or perfect forward secrecy. If an attacker or a virus gets access to your machine, all of your past gaim-encryption conversations are retroactively compromised. Further, since all of the messages are digitally signed, there is difficult-to-deny proof that you said what you did: not what we want for a supposedly private conversation!

Re:And for the chat

[cayenne8]

"Well in traditional crypto/signature schemes, having a provable relation between a specific message and specific sender is a desired attribute. While there are certainly situations where you would like to verify the identity of the person to which you are chatting (wife/girlfriend/boss/etc), it appears that is not one of the wanted 'features' of this encryption protocol. Forward and backward secrecy would certainly be something most would consider useful, however."

Well, you want to make sure it IS from the person you think it is, but, that doesn't mean you have to know who the person IS in real life.

It would be cool if these email plugins would help make it easy to register and use the nym servers. This way you could set up an email address on each end. PGP sigs can be used, but, there is plausible denyability as to who really is at each end of the email.

Of course if you're really worried about tracability, then set up a nym account to send out on, but, on return messages...just have it post encrypted to one of many USENET groups. You then really have a disconnect 'cause there's no good way to monitor around the world who gets what messages of USENET.

I wouldn't think google would like this

[kentmartin]

I thought their business model worked on the idea that they could datamine all your email and (among other things) offer you targeted email based on the content therein... this'll screw with that idea...

"BUY jjhHDJEy6786ERLKLXhdfeprERIOUPewoenOIhgshgrgeyrew now for a low price on Ebay.co.uk"

Re:I wouldn't think google would like this

[morgan_greywolf]

Nah, they'll just start sending 'Soldier of Fortune Magazine'-type ads at you.

Re:I wouldn't think google would like this

[CreatureComfort]

So... you are saying that the NSA has the ability and desire to break every ElGamel 2048-bit length encrypted message it captures with Echelon? I've seen too much of government from the inside to think that any agency operates as well as the NSA FUD would have us believe. Especially when you realize it is far easier and cheaper to make your enemies believe you have super powers than it is to actually develop those super powers, completely in-house with no outside knowledge or help.

Re:I wouldn't think google would like this

[morgan_greywolf]

Gmail supports retrieval of mail via POP3 for free. So there's nothing to stop someone from using GPG and similar support already included in or available for a wide variety of e-mail clients such as Outlook, Thunderbird, Evolution, Eudora, etc.

Re:Nerds with something to hide

[morgan_greywolf]

I don't understand this fascination with encryption. Why do people use it. Is it because you're hiding something illegal? It's kiddie porn isn't it? Be honest!

Nope. It's secret terrorist plots to overthrow the tyrannical American Government!

Oh, wait! I wasn't supposed to say that, was I?

Altered for slashdot

[LiquidCoooled]

-----BEGIN PGP MESSAGE-----
Version: GNUPG v0.4.0 (GNU/Linux)
Comment: Wonderful
ewurnfi3u834j9few4jf9oewfqvi7y&H*&HAwr8hw78er7hfw8 f7hh4839h47f7e
wf8943f89jw3r8j9fesajaejro5gvl;rhyklyfp[ult0h43jg8 394g84953jgf84
fnw98efj89324rtuerjgeiorgtjerilgtjireogniregunreng erniguiregt980
werj
-----END PGP MESSAGE-----

I have nothing more to add

Re:Altered for slashdot

[kypper]

You want me to do what with hot grits?

Re:Nerds with something to hide

[fluch]

It is just that I don't want anybody to intrude my privacy. Do you close the envelope of a regular snail-mail letter? If so, do YOU have something to hide??

Does not this break GMAIL's business model?

[mi]

I thought, their ability to automatically parse the messages — so as to show users the relevant advertisements, was the reason, I am getting an unlimited mailbox with nice interface for free.

If all/most of my messages are encrypted, how will they know, what to peddle to me? Can't do much on Subjects alone... Or can they?

Re:Does not this break GMAIL's business model?

[$RANDOMLUSER]

If all/most of my messages are encrypted, how will they know, what to peddle to me?

Aluminum foil. Survival equipment. Wellbutrin.

Re:Nerds with something to hide

[joe_cot]

I don't actually use it for encryption; I use it for verification.

Besides encryption, GPG also allows you to sign messages, ensuring that the message is indeed from you, and hasn't been modified after you've signed it. In the Ubuntu Community, this is important for a) verifying messages from developers are real, b) verifying that uploaded packages were created by trusted developers, c) verifying signatures (such as signing the code of conduct).

While FireGPG is useful, it's not so useful for signing messages; gmail auto-wordwraps messages after you send them, and FireGPG doesn't take that into account. Therefore, unless you wordwrap it yourself, gmail's going to add line breaks, and your signature will be invalid. When I need to sign messages, I either word wrap myself so that gmail doesn't, or send it through Thunderbird using Enigmail.

Point & Click Encryption?

[RubberChainsaw]

This extension seems very cool, and I plan to try it out when I get home. When I first read the summary I thought to myself, "A firefox extension and gmail, how much simpler could it get!" But, unfortunately this is not point & click encryption. It requires an additional external program (GnuPG) to function. Even this small, relatively trivial step is too much for beginning to average computer users. Encrypted email is great and all, but I can only send it to other people with encryption-enabled email clients.

Where is the it-just-works email encrytion for dummies?

Re:Point & Click Encryption?

[LiquidCoooled]

When I want to totally encrypt an email I just plug in my DVORAK keyboard, put on a blindfold and type as usual.

Re:Point & Click Encryption?

[Kadin2048]

Where is the it-just-works email encrytion for dummies?

AFAICT, it doesn't exist. At least not outside of corporate environments. There are lots of companies that have their encryption set up so that it's transparent to non-technical employees, but it's a lot of work for the people who actually make it run. Lotus Notes, for instance, will do public-key cryptography, using company-wide keyservers -- although it's a proprietary algorithm, or was last time I checked. Once you have the infrastructure in place, the users don't have to think much about it, besides clicking 'encrypt and sign' on the emails they want secured.

I've also heard that within Apple, they use Apple Mail with S/MIME to great effect ... but if you're just a regular user, getting that feature working is a real PITA. (Though admittedly, most of the trouble is because of the certificate authorities.)

I think the problem with the free encryption tools is that they're still very much a 'hacker's product,' being designed by fairly advanced users, for other advanced users -- or at least, for users who don't have a problem installing extra software in order to communicate securely. This, IMO, is a mistake; in order for an encryption system to be useful, it has to be widely used. And that means getting it into the hands of people who might not even think, in advance, that they want it. There are lots of people who aren't going to go out and download/install encryption software, but if the feature was there, and working, all the time, they'd probably find themselves clicking the 'Encrypt' button quite a bit.

There's no real reason why encryption can't be built in. It's just that it tends to get viewed as a peripheral, rather than core, feature, in everything except some corporate packages. However, I think that if it was incorporated more widely, it would quickly become a core feature; but getting over that 'chicken and egg' hump is hard.

Say 'no' to gaim-encryption, use OTR

[Kadin2048]

OTR is miles better than the gaim-encryption/pidgin-encrypt. Honestly, I don't understand why they won't just kill it and move to OTR for good; it's a fundamentally better security model for something transient like instant messages.

Particularly since having two mutually-incompatible encryption packages is a pretty crummy state of affairs; it just means that the few users who do use encryption, are going to be fragmented between incompatible systems.

OTR probably has the greatest market penetration of any IM-encryption system, outside of corporate clients (Sametime, I think, uses encryption by default, although I don't think it's end-to-end, only client-server, because there they want the ability to intercept on the server), because it's built into the fairly popular OS X Adium client. So there's already quite a few users out there who have software that supports it. If only some of the other IM clients would start building it in by default, rather than making it an optional addon, I think it would quickly gain traction as a de facto standard. (And that would be a good thing, since it's a good system and open source.)

Re:Nerds with something to hide

[SCHecklerX]

You are forgetting about authentication. Email is trivial to spoof. If you *always* sign your messages, then when some asshat, say, decides to send an explicitly detailed nastygram to your boss from 'you', it is easy to prove otherwise...

Or maybe from your secret lover, etc. You get the picture.

Re:Or you can use an actual mail client

[Enoxice]

Psh, Lynx. Get with the times, man, everyone is using links2 (perhaps links2 -g if they want to be on the bleeding edge).

Re:Nerds with something to hide

[brunascle]

perhaps because i'd like to send an email from work to my GF with something like "hey wanna fuck tonight?" and i'm not particularly keen on the network guys reading that.

GMail S/MIME plugin for firefox

[emj]

I've been using the S/MIME plugin for Firefox. and it's great. I'm not sure I like the way you have to apply for a certificate from Thawte, but it works and it's very painless.

This is not painless and easy, and IMHO S/MIME is alot nicer implemented than PGP signatures.

Re:Nerds with something to hide

[daeg]

Clever. Hiding your kiddie porn encoded in anarchist rants! I'm onto you, buddy!

Works with any textarea, by the way

[croddy]

This works with any textarea, by the way, not just GMail. Not sure why the summary doesn't mention that.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This works with any textarea, by the way, not just GMail. Not sure why the summary doesn't mention that.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org/

iD8DBQFGZDU/WCKEX KsCq6IRAvAtAJ96BAdus/rVCXS+NxlEbMsDdNxTCgCfe+da
T yi/KWbgNLQUq/qssCj2YR4=
=Y2mA
-----END PGP SIGNATURE-----

Re:Nerds with something to hide

[toleraen]

I generally close the envelope of snail mail so the mail doesn't fall out.

I use security envelopes to obscure the contents of my mail. You probably would want to use that as an analogy instead.

Re:Nerds with something to hide

[Anonymous Coward]

So if you "always" sign your messages, then you can tell off anyone you want as long as you don't sign it. Brilliant!

Won't AJAX textboxes kill this?

[biftek]

I haven't used gmail that much, but I was under the impression that it saved drafts of what's in the composition textbox at intervals.

That data would be all cleartext wouldn't it? Seems a tad risky to me.

Your girlfriend called...

[xxxJonBoyxxx]

Hey, your girlfriend called. She said she couldn't read the garbled message you sent. However, I passed on your "wanna...tonight" message to her and she said "yes" but I don't think your name came up. So...if you don't mind, I'd like to get out a little early tonight...

Re:Nerds with something to hide

[Rob T Firefly]

This is your boss. The network guys tell me you've just used the Company's network to write "hey wanna fuck tonight?" on a public website. You're fired.

Re:Nerds with something to hide

[iago-vL]

Or maybe from your secret lover, etc. You get the picture.

It's that Cathy, isn't it? She's always trying to break up Alice and Bob!

Re:Nerds with something to hide

[XrayCharlie]

I use FireGPG along with It's All Text! plugin, which I can edit a textfield with an external editor such as Vim. Vim handles wordwrap for me. The only problem I have is that Gmail automatically makes links for URLs or email addresses, which breaks the signature.

Re:Nerds with something to hide

[ChrisMounce]

Anonymous Coward is hoping to make a fortune on Patent #53892647956403765437856348756438756487563, "Method for tucking the flap inside the envelope".

Re:Nerds with something to hide

[marimbaman]

The third participant in the conversation is usually Carol.

Re:Nerds with something to hide

[Tarquin Sidebottom]

Unfortunately wrap, htmlization and all that marlaky is a general problem when it comes to signing via web interfaces, be it gmail or some generic php webforum. I came across the same issue when I made a few comments in relation to the now stillborn EnigWeb project.

Perhaps it's time for a GPG-wide standard for 'verification-lite', aimed at web-traffic. The idea being to trade a small amount of security for method robustness. Rather than signing a bit-for-bit copy, sign a version where anything other than the main visible characters are ignored. New lines, carriage returns, tabs, multiple consecutive spaces, rare symbols that might by mangled by php scripts: all are ignored. So rather singing:

The cat sat on
the mat.

, you sign instead: 'Thecatsatonthemat.'.

Obviously, greater minds than mine need to sit down and assess the pros, cons and risks (more freedom to try and create collisions), but it strikes me as an idea worth considering.

Re:Nerds with something to hide

[brunascle]

hey guess what? fuck you.