Slashdot Mirror
Google Announces 'End-To-End' Encryption Extension For Chrome
Nexus Unplugged (2495076) writes 'On their security blog today, Google announced a new Chrome extension called "End-To-End" intended to make browser-based encryption of messages easier for users. The extension, which was rumored to be "underway" a couple months ago, is currently in an "alpha" version and is not yet available pre-packaged or in the Chrome Web Store. It utilizes a Javascript implementation of OpenPGP, meaning that your private keys are never sent to Google. However, if you'd like to use the extension on multiple machines, its keyring is saved in localStorage, which can be encrypted with a passphrase before being synced. The extension still qualifies for Google's Vulnerability Reward Program, and joins a host of PGP-related extensions already available for Chrome.'
Google also published a report showing how much email is encrypted in transit between Gmail addresses and those from other providers.
From joe scriptkiddy sure, but not from the people you actually don't want reading your mail.
It should be encrypted at all times.
This just help google.
Google will still have your internet/search/click usage information and will profit from it. It just makes harder for the goverment or another evesdroper to see what you are doing. But a every goverment is a subpoena away from it.
If you want anonimity, don't use google or their software/services. period.
Sorry about the sour post, but I don't see how this will change anything.
1: Compatible with OpenPGP (except for some reasonable caveats. Not bad.)
2: Some thought in building it, not just slinging a beta for download, wise.
3: Keys stored away from where the bad code can compromise a browser... smart.
So far, this seems to be something that can be useful for one who does use PGP or gpg often.
End-To-End doesn’t trust any website's DOM or context with unencrypted data.
I think this is the most important sentence in TFA, as it shows this is a real user-side-DRM (enforcing pivacy rights) in browsers.
Storing information in such a way that Google cannot hand the data over to 3rd parties will break many features that users like, searching emails being on the top of that list. Fully homorphic encryption is just not there yet.
So besides the fact that it's not in Google's interest to give you privacy, you can either put effort into it yourself to get some privacy or sit back and choose convenience. Choose one of the two but don't believe that technology like end-to-end encryption with a service provider will give you privacy as long as the service provider is not under your control.
I'm interested to see how the Google haters will spin this one as an evil plot.
That's the cynical in me talking...
You can't trust the source alone when they control the compiler. Remember 'reflections on trusting trust'? Not saying they did backdoor it, but if the government NSL'd them into doing so, would we be able to tell?
Not directly related to the subject matter, but I thought it was interesting that Gmail traffic spikes on Saturdays.
At first glance, this looks like a good idea which should be encouraged and nurtured. Even if they fuck up something.
The downside is that it's pretty crazy to be doing stuff like this in a scripting language inside of a machine that downloads new versions from somewhere, at the drop of a hat, and where the machine itself (Chrome) is remotely-coercible. (In other words, point a gun at Google's head, and they will extract your key the next time you enter your passphrase.) But really I think this is a minor point! (bear with me; I know that sounds like a bombshell.)
It's good to for people to start using OpenPGP, even if they do some things wrong, and for it to get more mainstreamed. It'll get 'em familiar with the concepts (and they need to learn them all; take anything out and you have a broken system), and then some day they will graduate to the real thing (actual PGP or GnuPG, outside the vulnerable context of today's web browsers) and do things more carefully on their own time while remaining interoperable with their associates.
I know I am a dead-horse beater on this, but OpenPGP, after all these years, really is still the very best, top-notch, number one PK system we have. It's not merely good; it's right. And the applications for the WoT go far beyond merely securing communications from snooping, though it happens to be excellent that that. Three cheers for Google not inventing something gratuitously nonstandard (and therefore, probably deficient)!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
this sucks. now I'm going to have to CC all my email to the NSA just so I don't risk getting drone striked "just in case"
how many pairs of boxer shorts should you own?
... with all the filtering being done with a Google server.
Is anybody dumb enough to trust a company who's primary business is based on collecting data from the users??
The report showing how much email is encrypted in transit is about SMTP/TLS usage. But as I understand, this is security theater since certificate validation is not done. Most SMTP implementation work without a CA root repository, and therefore cannot assess the peer identity.
Computers are complicated. (most) Users are not. With computing, you basically have a trio of secure, easy, affordable - pick any two.
OpenPGP was right in all ways except one: you can't even explain what it does to your grandma, let alone get her to use it. Because of that, you can't get anybody to pay for it. So you really only have the choice of easy/affordable.
This is a good system if only because it gives you a bit of the secure leg without compromising the other two legs. It sucks, and propeller heads like you and me will snarl at the compromises involved.
Oh well!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Conflating encryption with DRM is like comparing door locks to handguns. Your statement is just wrong.
captcha: dummies
Come on Google, we know better than that. I knew it all along, but Snowden made it public to all. Most of the encryption tools out there have back doors for the Feds. All your search information can be collected to run a profile of your personality. Big Brother is extremely nosy, worse than a nagging parent that wants to pry into your life day in and day out. . Facebook is a Data Warehouse for the FEDS. When is everyone going to wake up ?
FCC CIO David Bray noted last night that the system is more than 10 years old and pointed to an article on how the FCC is trying to modernize infrastructure badly in need of upgrades.
So the FCC, the folks who are supposed to regulate our communications activities is in the technical stone age? Maybe they just need more of Ted Stevens' pipes?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It's not in Google's best interest not to be able to read our e-mails anymore. So why do they do this?