Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenPGP Implemented In JavaScript

Posted by Unknown on from the what-won't-someone-do-next dept.

angry tapir writes with this excerpt from Tech World: "Researchers from German security firm Recurity Labs have released a JavaScript implementation of the OpenPGP specification that allows users to encrypt and decrypt webmail messages. Called GPG4Browsers, the tool functions as an extension for Google Chrome and now is capable of working with GMail." A quick gander at the source leaves me with the impression that it should be more or less portable to other browsers. It's also built using a lot of off-the-shelf Javascript libraries. (Who knew Javascript had a bignum library and a number of cipher implementations?)

2 of 167 comments (clear)

  1. Re:Yeah right by Chrisq · · Score: 4, Informative
    Where do you get it that anyone but you has your private key? From TFA:

    A PGP user who wants to send and receive encrypted emails from a different computer, would have to install it on that system first, import his private and public keys into the local database, known as the keyring, and then configure his email client.

  2. Re:Isn't encryption in JavaScript considered harmf by Chrisq · · Score: 4, Informative

    http://www.matasano.com/articles/javascript-cryptography/

    The above was written by someone without an understanding of public key cryptography. All you need to do is ensure that the crypto JavaScript is delivered through a secure channel. Once you have done that you can publish a public key on an insecure site and allow people to send data to you which cannot be intercepted. You can also let them generate a key pair and send you the public key, after which you can send them a response.