Slashdot Mirror
Google Open Sources Encrypted Email Extension For Chrome (onthewire.io)
Last week Google released E2EMail, "a Gmail client that exchanges OpenPGP mail." Google's documentation promises that "Any email sent from the app is also automatically signed and encrypted... The target is a simple user experience -- install app, approve permissions, start reading or send sending messages." Trailrunner7 quotes On The Wire:
People have been trying to find a replacement for PGP almost since the day it was released, and with limited success. Encrypted email is still difficult to use and painful to implement in most cases, but Google has just released a Chrome plugin designed to address those problems.
The new E2EMail extension doesn't turn a user's Gmail inbox into an encrypted mail client. Rather, it is a replacement that gives users a separate inbox for encrypted messages. The system is built on Google's end-to-end encryption library, and the company has released E2EMail as an open-source project.
Wired quotes a web security researcher who calls the open sourcing "a telltale sign the project isn't going anywhere. This is a way for them to get their work out there but to absolve themselves of future obligations." But Google's privacy and security product manager responds that they're tackling some very thorny issues like secure key handling, and "The reason we want to put this into the open source community is precisely because everyone cares about this so much. We don't want everyone waiting for Google to get something done."
Wired quotes a web security researcher who calls the open sourcing "a telltale sign the project isn't going anywhere. This is a way for them to get their work out there but to absolve themselves of future obligations." But Google's privacy and security product manager responds that they're tackling some very thorny issues like secure key handling, and "The reason we want to put this into the open source community is precisely because everyone cares about this so much. We don't want everyone waiting for Google to get something done."
encrypted email provide privacy! We have to work on this
Having a plugin is nice, but it doesn't solve the PKI (key distribution and reputation) problem, and I am not very inclined to trust a plugin made by a company whose primary line of business is advertising by building user profiles.
How about support for SMIME ?
It would be nice if they supported DANE so that all the keys where looked up automatically!
Why not ?
John
I hate DRM as much as anyone but lets face it, if he did not ratify it into the standard, DRM isn't just gonna magically go away.
The only effect not ratifying it would actually have is to ensure the continued existence of a fragmented mess of multiple different actual implementations across different sites.
So why is e2email by e2email-org and not by Google?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
People have been trying to find a replacement for PGP almost since the day it was released
I've been around since PGP first popularized public key email and while there have been various problems with Zimmerman's implementation from time to time (as with S/MIME since)... I do not recall any broad opposition to it or GnuPG... besides intelligence agencies who would be satisfied with nothing less than outlawing non-escrow encryption. We were in fact excited and intrigued by it, and it was fun to use even if you weren't paranoid. This must be a dispatch from the Millennial Alternate Universe where or any project emitted by Microsoft or promised by Google or announced in a press release is considered to be a vast improvement on what came before it.
End-To-End Encryption implemented solely in Javascript which is served up by the company that's not supposed to be spying on you is not worth the paper it's printed on. And Key Transparency is a fancy way of saying, use our single point of failure Internet Gizmo 'solution' to handle key management so you don't have to think about insurmountable issues of trust, as were directly addressed in Zimmerman's day (key signing parties, etc.).
<blink>down the rabbit hole</blink>
It's not hard to do PGP. It's only hard to do it properly, so that the Web of Trust works like it is supposed to.
It does not scale. You can create a key for any domain with no verification - remember people tend to blindly click accept. You can create key with no expiration date, or long expiration dates - I'm sorry, but that is stupid.
> this stupid FUD that PGP/GPG is somehow "difficult" really gets on my nerves.
> With a functioning mail client it's not very difficult.
Well, there's the crux, ain't there, buddy. There is zero to none 'functioning email client' in that respect, as far as I see it!
Opportunistic encrption? Nope. Automatic key exchange? Nope. Hell...built-in functionality by default, nevermind it being turned on in the first place? Nope, nope, nope.
The MUA's are the primary reason, why PGP IS 'difficult' to use. Instead of install and forget we get to talk to Grandma about 'per-recipient rules' and other nonsense.
The WoT is highly overrated, though a technically clever idea. Except it don't work at scale and mostly not at all.
Ditto keyservers. The reliance on the has got to be the stupidest thing ever. MUA's should directly and automatically exchange keys. End of story. And go jump out a window before you reply with any nonsense about key validity, that can't be ascertained in 90%+ of cases anyway!
There are some, who have indeed used PGP since it came out and had high hopes for it. It's a cool idea, it can be done. But it's way, WAY more unreasonably involved and difficult than it needs to be. So wake me up, when Thunderbird et all has it actually activated by default and I can install it like HTTPS-Everywhere for Grandma and it just works out-of-the-box! Perhaps with a lower security level (naturally), but works nevertheless!
Unlike useful applications like Picasa that Google just dumped unceremoniously without patching significant bugs like its inability to scale previews to different resolutions.