Slashdot Log In
Encrypt and Sign Gmail messages with FireGPG
Posted by
CmdrTaco
on Mon Jun 04, 2007 11:26 AM
from the can-you-spot-the-secret-message-in-this-dept-line dept.
from the can-you-spot-the-secret-message-in-this-dept-line dept.
Linux.com (Same owners as Slashdot) has a story up about FireGPG and says "Gmail may be an excellent Web-based email application, but there is no easy way to use it with privacy tools like GnuPG. The FireGPG extension for Firefox is designed to solve this problem. It integrates nicely into Gmail's interface and allows you...
Encrypt and sign Gmail messages with FireGPG
Encrypt and sign Gmail messages with FireGPG
Related Stories
[+]
Technology: Point-and-Click Gmail Hacking Shown at Black Hat 260 comments
not5150 writes "Using Gmail or most other webmail programs over an unsecured access point just got a bit more dangerous. At Black Hat Robert Graham, CEO of errata security, showed how to capture and clone session cookies very quickly over connections without encryption. He even hijacked a shocked attendee's Gmail account in the middle of his presentation. 'While Ou was typing, Graham was running Ferret and sniffing all the cookies that were being sent from Ou's laptop and Google. Graham then clicked on Ou's IP address and Gmail page, complete with Ou's recently sent message on the screen. We photographed both Graham's and Ou's laptop at that time and posted it to the picture gallery. You'll see that the contents are exactly the same.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The Fascination with Encryption (Score:5, Funny)
Keeps the snoops on their toes.
Re:The Fascination with Encryption (Score:5, Funny)
I keep them on their toes by acting completely normal, having them looking for steganography.
Parent
Re:The Fascination with Encryption (Score:5, Funny)
Parent
And for the chat (Score:5, Informative)
Re:And for the chat (Score:5, Insightful)
How is this different from the gaim-encryption plugin?
The gaim-encryption plugin provides encryption and authentication, but not deniability or perfect forward secrecy. If an attacker or a virus gets access to your machine, all of your past gaim-encryption conversations are retroactively compromised. Further, since all of the messages are digitally signed, there is difficult-to-deny proof that you said what you did: not what we want for a supposedly private conversation!
Parent
Say 'no' to gaim-encryption, use OTR (Score:5, Interesting)
Particularly since having two mutually-incompatible encryption packages is a pretty crummy state of affairs; it just means that the few users who do use encryption, are going to be fragmented between incompatible systems.
OTR probably has the greatest market penetration of any IM-encryption system, outside of corporate clients (Sametime, I think, uses encryption by default, although I don't think it's end-to-end, only client-server, because there they want the ability to intercept on the server), because it's built into the fairly popular OS X Adium [adiumx.com] client. So there's already quite a few users out there who have software that supports it. If only some of the other IM clients would start building it in by default, rather than making it an optional addon, I think it would quickly gain traction as a de facto standard. (And that would be a good thing, since it's a good system and open source.)
Parent
I wouldn't think google would like this (Score:5, Interesting)
"BUY jjhHDJEy6786ERLKLXhdfeprERIOUPewoenOIhgshgrgeyrew now for a low price on Ebay.co.uk"
Re:I wouldn't think google would like this (Score:5, Funny)
Parent
Re:I wouldn't think google would like this (Score:5, Insightful)
So... you are saying that the NSA has the ability and desire to break every ElGamel 2048-bit length encrypted message it captures with Echelon? I've seen too much of government from the inside to think that any agency operates as well as the NSA FUD would have us believe. Especially when you realize it is far easier and cheaper to make your enemies believe you have super powers than it is to actually develop those super powers, completely in-house with no outside knowledge or help.
Parent
Altered for slashdot (Score:5, Funny)
Version: GNUPG v0.4.0 (GNU/Linux)
Comment: Wonderful
ewurnfi3u834j9few4jf9oewfqvi7y&H*&HAwr8hw78er7hfw
wf8943f89jw3r8j9fesajaejro5gvl;rhyklyfp[ult0h43jg
fnw98efj89324rtuerjgeiorgtjerilgtjireogniregunren
werj
-----END PGP MESSAGE-----
I have nothing more to add
Re:Altered for slashdot (Score:5, Funny)
Parent
Works with any textarea, by the way (Score:5, Informative)
Won't AJAX textboxes kill this? (Score:5, Interesting)
That data would be all cleartext wouldn't it? Seems a tad risky to me.
Re:Nerds with something to hide (Score:5, Funny)
Nope. It's secret terrorist plots to overthrow the tyrannical American Government!
Oh, wait! I wasn't supposed to say that, was I?
Parent
Re:Nerds with something to hide (Score:5, Funny)
Parent
Re:Nerds with something to hide (Score:5, Insightful)
Parent
Re:Nerds with something to hide (Score:5, Insightful)
I use security envelopes to obscure the contents of my mail. You probably would want to use that as an analogy instead.
Parent
Re:Nerds with something to hide (Score:5, Informative)
Besides encryption, GPG also allows you to sign messages, ensuring that the message is indeed from you, and hasn't been modified after you've signed it. In the Ubuntu Community, this is important for a) verifying messages from developers are real, b) verifying that uploaded packages were created by trusted developers, c) verifying signatures (such as signing the code of conduct).
While FireGPG is useful, it's not so useful for signing messages; gmail auto-wordwraps messages after you send them, and FireGPG doesn't take that into account. Therefore, unless you wordwrap it yourself, gmail's going to add line breaks, and your signature will be invalid. When I need to sign messages, I either word wrap myself so that gmail doesn't, or send it through Thunderbird using Enigmail.
Parent
Re:Nerds with something to hide (Score:5, Informative)
Or maybe from your secret lover, etc. You get the picture.
Parent
Re:Nerds with something to hide (Score:5, Insightful)
Parent
Re:Nerds with something to hide (Score:5, Funny)
Parent
Your girlfriend called... (Score:5, Funny)
Parent
Re:Does not this break GMAIL's business model? (Score:5, Funny)
Parent
Re:Or you can use an actual mail client (Score:5, Informative)
Parent
Re:Point & Click Encryption? (Score:5, Insightful)
AFAICT, it doesn't exist. At least not outside of corporate environments. There are lots of companies that have their encryption set up so that it's transparent to non-technical employees, but it's a lot of work for the people who actually make it run. Lotus Notes, for instance, will do public-key cryptography, using company-wide keyservers -- although it's a proprietary algorithm, or was last time I checked. Once you have the infrastructure in place, the users don't have to think much about it, besides clicking 'encrypt and sign' on the emails they want secured.
I've also heard that within Apple, they use Apple Mail with S/MIME to great effect
I think the problem with the free encryption tools is that they're still very much a 'hacker's product,' being designed by fairly advanced users, for other advanced users -- or at least, for users who don't have a problem installing extra software in order to communicate securely. This, IMO, is a mistake; in order for an encryption system to be useful, it has to be widely used. And that means getting it into the hands of people who might not even think, in advance, that they want it. There are lots of people who aren't going to go out and download/install encryption software, but if the feature was there, and working, all the time, they'd probably find themselves clicking the 'Encrypt' button quite a bit.
There's no real reason why encryption can't be built in. It's just that it tends to get viewed as a peripheral, rather than core, feature, in everything except some corporate packages. However, I think that if it was incorporated more widely, it would quickly become a core feature; but getting over that 'chicken and egg' hump is hard.
Parent