Slashdot Mirror
Google Announces 'End-To-End' Encryption Extension For Chrome
Nexus Unplugged (2495076) writes 'On their security blog today, Google announced a new Chrome extension called "End-To-End" intended to make browser-based encryption of messages easier for users. The extension, which was rumored to be "underway" a couple months ago, is currently in an "alpha" version and is not yet available pre-packaged or in the Chrome Web Store. It utilizes a Javascript implementation of OpenPGP, meaning that your private keys are never sent to Google. However, if you'd like to use the extension on multiple machines, its keyring is saved in localStorage, which can be encrypted with a passphrase before being synced. The extension still qualifies for Google's Vulnerability Reward Program, and joins a host of PGP-related extensions already available for Chrome.'
Google also published a report showing how much email is encrypted in transit between Gmail addresses and those from other providers.
From joe scriptkiddy sure, but not from the people you actually don't want reading your mail.
This just help google.
Google will still have your internet/search/click usage information and will profit from it. It just makes harder for the goverment or another evesdroper to see what you are doing. But a every goverment is a subpoena away from it.
If you want anonimity, don't use google or their software/services. period.
Sorry about the sour post, but I don't see how this will change anything.
1: Compatible with OpenPGP (except for some reasonable caveats. Not bad.)
2: Some thought in building it, not just slinging a beta for download, wise.
3: Keys stored away from where the bad code can compromise a browser... smart.
So far, this seems to be something that can be useful for one who does use PGP or gpg often.
End-To-End doesn’t trust any website's DOM or context with unencrypted data.
I think this is the most important sentence in TFA, as it shows this is a real user-side-DRM (enforcing pivacy rights) in browsers.
Storing information in such a way that Google cannot hand the data over to 3rd parties will break many features that users like, searching emails being on the top of that list. Fully homorphic encryption is just not there yet.
So besides the fact that it's not in Google's interest to give you privacy, you can either put effort into it yourself to get some privacy or sit back and choose convenience. Choose one of the two but don't believe that technology like end-to-end encryption with a service provider will give you privacy as long as the service provider is not under your control.
That's kind of the point of this extension...
Not directly related to the subject matter, but I thought it was interesting that Gmail traffic spikes on Saturdays.
then use chromium the open source fork and look at the code yourself
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
How would that help?
What would me, you, or him reading the code accomplish? I guaranty that none of us would spot an NSA level backdoor.
Open Source guarantees optimal security, if you are one of the top ten security professions on the planet and basically have enough time to write the software yourself.
Troll is not a replacement for I disagree.
They could do like Hushmail and serve a specially crafted JavaScript file to users being targeted by law enforcement.
That sort of thing would be pretty easy to detect. Google would be outed unless it were only done on a very small scale, and even then it would be risky.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
At first glance, this looks like a good idea which should be encouraged and nurtured. Even if they fuck up something.
The downside is that it's pretty crazy to be doing stuff like this in a scripting language inside of a machine that downloads new versions from somewhere, at the drop of a hat, and where the machine itself (Chrome) is remotely-coercible. (In other words, point a gun at Google's head, and they will extract your key the next time you enter your passphrase.) But really I think this is a minor point! (bear with me; I know that sounds like a bombshell.)
It's good to for people to start using OpenPGP, even if they do some things wrong, and for it to get more mainstreamed. It'll get 'em familiar with the concepts (and they need to learn them all; take anything out and you have a broken system), and then some day they will graduate to the real thing (actual PGP or GnuPG, outside the vulnerable context of today's web browsers) and do things more carefully on their own time while remaining interoperable with their associates.
I know I am a dead-horse beater on this, but OpenPGP, after all these years, really is still the very best, top-notch, number one PK system we have. It's not merely good; it's right. And the applications for the WoT go far beyond merely securing communications from snooping, though it happens to be excellent that that. Three cheers for Google not inventing something gratuitously nonstandard (and therefore, probably deficient)!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Google for "double diverse compiling" and educate yourself a little more.
Learning HOW to think is more important than learning WHAT to think.
Remember 'reflections on trusting trust'?
That again?
With that said, this is just ridiculous. What if you're actually the only sentient being in existence, and everything is just part of your dream? What if we're all in the matrix? What if, what if, what if!
Personally, I don't care about vastly unlikely possibilities. Something needn't be 100% safe for me to use it. Obviously. I don't see why people are obsessed with all these vastly unlikely possibilities.
Challenge Accepted!!
They want to allow people to be reassured that they have "enough" privacy by giving them tools that will protect them from other end users learning their secrets, whatever they've decided those secrets should be.
Their saleable advantage is that they can let people manipulate you. They've been using mass analysis of mail as a way to better do that since their mail services were invite only.
They want you to be satisfied with them not just invading your privacy, not just manipulating you with what they learn, but manipulating you for anyone who wants to pay.
But don't worry, your data is secure in transit!
-1 Uncomfortable Truth
It should be encrypted at all times.
Great idea. Perhaps they should call it "End-to-End" encryption and release it as a Chrome browser extension like they are talking about in this article: http://slashdot.org/story/14/06/03/2059220/google-announces-end-to-end-encryption-extension-for-chrome/
this sucks. now I'm going to have to CC all my email to the NSA just so I don't risk getting drone striked "just in case"
how many pairs of boxer shorts should you own?
And all of it updates automatically and silently from Google on a regular basis. It's OK though, I'm sure they'd never silently ship a backdoored version to a specific target in compliance with a NSL...
There's no place I could be, since I've found Serenity...
The report showing how much email is encrypted in transit is about SMTP/TLS usage. But as I understand, this is security theater since certificate validation is not done. Most SMTP implementation work without a CA root repository, and therefore cannot assess the peer identity.
That's weird that article has the exact same comment on it linked here: http://slashdot.org/comments.p...
Computers are complicated. (most) Users are not. With computing, you basically have a trio of secure, easy, affordable - pick any two.
OpenPGP was right in all ways except one: you can't even explain what it does to your grandma, let alone get her to use it. Because of that, you can't get anybody to pay for it. So you really only have the choice of easy/affordable.
This is a good system if only because it gives you a bit of the secure leg without compromising the other two legs. It sucks, and propeller heads like you and me will snarl at the compromises involved.
Oh well!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Clearly refusing to comply with China's censorship and cooperation demands was all a ruse to make us THINK they were pro-user rights. Clearly their cooperation with the EFF and ChillingEffects to publicly report on DMCA (and other) takedowns is all a trick to get our precious, precious page impressions. Clearly their ahead-of-the-curve SSL by default on google.com is all because theyre in bed with Uncle Sam.
Not sure what you're smoking but keep it away from me.
Guess how I know you didnt read the article?
Heres a hint: your post does not address anything mentioned in the article. Its not server-side encryption, its end-to-end (hence the name).
It only takes one motivated person to find and publish the backdoor for it to become worthless.
Sure. But where exactly is this mythical "one motivated person" who can so easily spot bugs? We've seen countless examples of security bugs in F/OSS projects staying hidden for YEARS despite people having given the code a once-over. Heck, Linux developers themselves continue to introduce security vulnerabilities in every single release. (AFAIK no Linux release has been free of security bugs). So yeah, you can continue to live in your fantasy land.
Its certainly not encrypted when Google receives it. Encrypted data is useless to Google.
FCC CIO David Bray noted last night that the system is more than 10 years old and pointed to an article on how the FCC is trying to modernize infrastructure badly in need of upgrades.
So the FCC, the folks who are supposed to regulate our communications activities is in the technical stone age? Maybe they just need more of Ted Stevens' pipes?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Comparing the relation between DRiM (Digital Rights Management, what FSF and "End-To-End" do) and DReM (Digital Restrictions Management, what MPAA and Netflix do) with the physical world is like comparing movie pirates to physical thieves.
We live in a digital war on Data. There are entities wanting our data, and there are others which don't want to give their data to us, even if they make their living doing that. Perhaps it is natural to demonize the weapons the other side uses, I don't know.
Only the single intended victim would receive the specially modified Javascript from the NSA's MITM server,
As I said, it would be outed unless it were only done on a very small scale.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
And all of it updates automatically and silently from Google on a regular basis. It's OK though, I'm sure they'd never silently ship a backdoored version to a specific target in compliance with a NSL...
I don't think an NSL could order that. And, if one tried, I'm quite confident the Google legal team would fight it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Sure, but encrypting the connection from the user to the provider is usually not a big deal for the modestly tech-savvy; most SMTP and IMAP daemons make it easy to enable encryption, and as a consequence, most providers do support it; it's simply up to the user to tick the box in their e-mail client. Inter-provider transit is much more problematic in that sense because it's out of the user's hand and can readily be sniffed by the NSA and the likes without anyone getting the wiser. I've always been wondering about the state of e-mail encryption in transit; this report confirms my suspicion it's pretty poor, and user-side public key encryption is still a must for really sensitive information; one can safely assume that everything else WILL end up in the NSA's data centers. Unfortunately, user-side public key encryption is a bit of a pain in a lot of settings; encrypting the SMTP connections between the providers would still be desirable, even though it doesn't protect the user against the providers themselves becoming compromised.
Why wouldn't you be able to spot a back door that's in the code?
It's not that hard.
Of course if the backdoor is being inserted by the compiler, well then you are screwed. Or, use your own compiler.
The Kruger Dunning explains most post on
It is with this encryption.
" Encrypted data is useless to Google."
arguable, but so what? Why does that mean they wouldn't do it? Your hate boner is getting in the way for your thinking.
stop it.
The Kruger Dunning explains most post on
It's not in Google's best interest not to be able to read our e-mails anymore. So why do they do this?