(Simple) Chrome plugin for GPG/PGP in GMail | Hacker News Reader

(Simple) Chrome plugin for GPG/PGP in GMail

thinkst.com

45 pointsmh_13 comments

Neat idea, and I know it's a cute hack, but

1) You ask for all data on my personal computer and all data on all websites. What?! I imagine you might require local data access to get my GPG key and Chrome doesn't allow it more fine-grained than that (but forchrissakes tell me that on your site), but why all sites? Why not mail.google.com and gmail.com? Because of apps for your domain?

2) You're providing a crypto product. I want to see your source code, and don't tell me to unzip/tar/whatever your crx.

Link to the src has been added to the site. (sorry we included it when we mailed the gpg mail list, but didn't add it to the page)

Direct Link: https://github.com/RC1140/cr-gpg

A quick note, apps for domains are still served from https://mail.google.com/a/example.com/

How do you manage your private keys not getting into Javascript land & being POSTed out to an arbitrary site?

We don't store the password in the DOM. When you choose to sign/encrypt, the password is passed to gpg (via the plugin) and promptly goes out of scope. (It means you have to enter your password every time you want to sign/encrypt, but this seems safer)

Goes...out of scope.

I am suspicious that that's not really sufficient password protection. What protection do you have from an attack that provides access to your machine's address space? (or chrome's address space)?

I'd like to see the source code before I use this. If that sounds paranoid, it's because if I'm using crypto, it's because I'm concerned about snoopers.

--- edit - source got posted. Thanks!

-nod- an attack with full access to chromes address space would grab the password in memory.

I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)

Could you mitigate that by having a separate process to do the crypto, which the plugin talks to by IPC? The separate process is then the one that prompts for the password.

This would also mean you don't have to reenter your password every time.

You're at zero right now because my finger slipped. Sorry about that.

I don't see a reason why private keys should be accessible via Javascript at all. It's a plugin and not a JS-based extension. With the right API the JS code would never see the private keys.

Sure. But people make mistakes. And it behooves one to be careful with their crypto.

c.f. Zimmarman's Snake Oil essay & its comments today: http://news.ycombinator.com/item?id=2917384

If your keys are on a smartcard, you don't need to worry about that. The OS couldn't give up your keys even if it wanted to.

The plugin has 2 quick updates: a) It's now site restricted to mail.google.com b) Will make use of chromes update feature in the future.

Please grab the new version from http://thinkst.com/tools/cr-gpg/

Reply on news.ycombinator.com