Hacker News Reader

Comment by moe | Hacker News Reader

Wouldn't it make more sense to revive FireGPG[1] and, while you're at it, port it to all other major browsers?

I am still disappointed that PGP in the browser never gained traction. Not only would it help with e-mail security, it could also be used for passwordless website logins, portable web identities, all that jazz[2].

One proper, user-friendly browser plugin could put an end to all those nasty kludges called OAuth, OpenID, LastPass, etc...

[1] http://getfiregpg.org/s/home

[2] http://en.wikipedia.org/wiki/Web_of_trust

View on HN

I'm currently working on this. So far, recognition of encrypted text and decryption works fine. However, it breaks Gmail if the text is part of an email there - only reloading get's it to work again.

Since I have zero experience with JS, I'm thankful for any help. Code is on: https://github.com/Mononofu/CryptoChrome

The plugin I'm using was compiled on Ubuntu x64 and probably doesn't work anywhere else. It was written using firebreath, basically it's just a wrapper to gpg.

Are there any webmail providers out there that support PGP? GMail never will since it needs the ability to read your email to show you ads.

HushMail and Countermail do. I think it never really caught on because if you really care about end-to-end security, you wouldn't be using a webmail provider.

If you had a working (and secure) crypto on the client side you could use a webmail provider and still be secure.

I can imagine an extension for Chrome or Firefox that will not be updated without my knowledge and has been peer reviewed like gnupg.

As long as the extension does not then place the cleartext back into the DOM. I would also want support on my Android phone too. So I guess basically, it's never happening.

If I can't safely check my mail from random computers anyway, I'd just as soon remove the browser from the equation and use a GPG-compatible mail client.

HushMail has a java based browser that's supposed to be all client side, but last time I tried hush, they generated keys that were incompatible with GPG2.

But yeah, like you said, if you're only checking emails on machines that are secure and in your control, you might as well just install Tbird/Enigmail. And if you're at the library or a computer lab, you can't trust the client to be secure.

> GMail never will since it needs the ability to read your email to show you ads.

It could still read your email after decryption and show ads based on that, it would be easy to do with JS. Search would be broken though unless they encrypt each word separately, but that would make your inbox size grow quickly, still doable.

Reply on news.ycombinator.com