Encrypting Google Calendar With Firefox Extensions

mrcgran writes "IBM's Nathan Harrington has an interesting essay on using open-source tools to ensure privacy on Google Calendar: 'Today's Web applications provide many benefits for online storage, access, and collaboration. Although some applications offer encryption of user data, most do not. This article provides tools and code needed to add basic encryption support for user data in one of the most popular online calendar applications. Building on the incredible flexibility of Firefox extensions and the Gnu Privacy Guard, this article shows you how to store only encrypted event descriptions in Google's Calendar application, while displaying a plain text version to anyone with the appropriate decryption keys.'"

Comments

And the ads?

[McGiraf]

I wonder what weird context ads will show up on a gmail page full of encrypted stuff.

Re:And the ads?

[saibot834]

None, if you not only use this story's extension, but also Adblock Plus.

Re:And the ads?

[vain gloria]

Are any of these extensions (CalendarEncrypt, Adblock Plus) against the TOS? As much as I believe that you should be allowed to do whatever you want on your computer, when your data is in the cloud the provider can always pull the plug so you better not ignore the TOS.

The cloud is a lie. One we're better off not perpetuating at that. Our data is on Google's servers, under their control and used for their benefit. I realise you're referring unambiguously to this yourself when you talk about breaching their TOS, but I'm against embracing nebulous non-threatening jargon which obscures the true state of our personal information.

As to your point, I have no idea whether these tools are against the TOS. Since everyone includes the proviso that their terms can be unilaterally revised at any time, there's no reason why they shouldn't become so in the future.

Re:And the ads?

[MagdJTK]

eqdauyebguuheqaswgddqjxktrfevamsdessypwnwsngqoxuaqeanwhhjcxeaodnlyhw

Re:And the ads?

[General Wesc]

Looking for dmgs wcbetc xgamgamqr p?
Find exactly what you want today!
www.eBay.com

afafasdf

[Heem]

jub arrqf nyy gung penc? Whfg hfr guvf xvpx-nff rapelcgvba zrgubq gung abobql pbhyq rire svther bhg!

Re:afafasdf

[thrillseeker]

Yes, I'll pay you Tuesday for the hamburger today, as scheduled.

Re:afafasdf

[Anonymous Coward]

Your confidence in that encryption method is intriguing, Mr. Urrz.

Re:afafasdf

[hostyle]

No I'm afraid the turtle escapade did not go quite as planned. Requesting a vet and some extraction tools. I submit that next time we grease the turtle and not the tubes. TTYL

Re:afafasdf

[strelitsa]

The chair is against the wall.

But ...

BUT ...

John has a SHORT moustache.

Re:afafasdf

[mrcgran]

The chair is against the wall.

But ...

BUT ...

John has a SHORT moustache.

thanks for presenting me to this wikipedia's article on number stations: http://en.wikipedia.org/wiki/Numbers_station

... "In the 1984 film Red Dawn, a band of high school guerrilla fighters hears two code phrases (each repeated twice) broadcast over the radio as they hide out in the wilderness. The phrases are: The chair is against the wall and John has a long mustache (the latter of which was actually used as a code-signal by the French Resistance during World War II)."

IBM pays people for this stuff...?

[HappyUserPerson]

I get why this article is on Slashdot (it's kind of cool), but why would IBM pay employees to work on this type of thing? It's impractical for several reasons...

Security & practicality:

1. You must install an add-in to use it. You want to your encrypted calendar with some friends. You tell them "uhh, just install this arbitrary XPI." No thanks.
2. No mention on how to securely transfer the private key to your friends. Email?
3. From your browser, the add-in spawns a shell to run a Perl script which passes arbitrary content to gpg. Security much?

Google:

1. This component is dependent on Google not changing their page. How would you and your friends like to recompile each time Google changes their page?
2. Who are you trying to protect your data from anyway? Google? They could change their page to by-pass your encryption and intercept new events as you post them. If you trust Google not to do that, what's the point? Just mark the entry as private and share it as appropriate...
3. It goes against Google's business. Okay if just a handful of users encrypt their events, no problem. However, displaying a bunch of base64 encoded garbage messes up Google's ads. Which, you know, is virtually their entire source of revenue. In the unlikely event that this technique became popular, Google would be forced to shut it down.
4. Google might shut it down anyway. It's a calendar. It's not for posting arbitrary base64 encoded data. If many users use Google calender for posting arbitrary binary data, calendar would quickly become a lawless file trading platform (think usenet) and create a performance, storage, and/or legal mess.

Re:IBM pays people for this stuff...?

[smallfries]

Under Security & Practicality you missed a few points:

4. It leaks information. The encrypted version shows when you are busy and free
5. There's no point using a 4096-bit key. Most calendar entries are 60 characters so the key size is overkill given there is probably less than 360 bits of entropy
6. Calendar entries are highly regular, a dictionary attack would be tractable regardless of the key-size because of the limited input space

Been There, Done That

[Anonymous Coward]

It's been done before. See a college project of mine called the Web Application Privacy Protector (WAPP) or here.

A major drawback is that it's usually very implementation-specific. The plugin has to be updated whenever the web application is significantly updated, and can usually be circumvented by the application provider if they really want. Additionally, encryption eliminates searchability, though there are some mediocre mitigations such as searchable encryption, tags, or searching for hashes of words. Note: WAPP hasn't been maintained since ~5/07, so it likely won't work with current applications without some tweaks.

If you have any questions, my email address is (my first name) DOT (my last name) at gmail.com.

- Gabriel Landau

Known plain-text attacks?

[spankymm]

Monday 9am - doing nothing
Monday 10am - doing nothing
Monday 11am - doing nothing
Monday 12pm - lunch
Monday 1pm - doing nothing
Monday 2pm - doing nothing ...

Actual ads from Google

[Xtifr]

jub arrqf nyy gung penc? Whfg hfr guvf xvpx-nff rapelcgvba zrgubq gung abobql pbhyq rire svther bhg!

Just out of curiousity, I posted that into a new email with gmail, saved it to my drafts folder, then went to look, and the "context" ads that appeared are:

Secrets of the Shaolin
Rare Chinese Scriptures Translated Released for 1st Time Ever

Try Tai Chi QiGong
Live A More Active & Fuller Life, DVD/Videos, Free & Fast Shipping!

Coconut Soup (Tom Kha)
Made with Fresh Coconut Milk Loaded with Lemongrass and Galangal

Chi Kung Resources
See How Chi Kung Can Empower You. Learn How Today!

BE a Yoga Teacher
Teacher Trainings for Women Sip the nectar of Prana in Baja

So, apparently, if you encrypt your data, Google thinks you're speaking some Asian language, but isn't exactly sure which one. :)