So long as the server has access to your plaintext as you compose it, the security is compromised and a third party has it. And then if the recipient views the plaintext from a browser...
If you want the email to be secret, it must be in it's encrypted form before the browser even knows about it ... but at that point, why not just use a different, well vetted client program for email?
(please read about things before taking it on yourself to educate others...)
It just seems like an unnecessary and avoidable risk.
Security is subject to browser exploits, that's true, but that has nothing to do with what you were saying above.
More than that if the third-party service is compromised they can MiTM your encrypted communications anyways.
You're also relying that the third-party extension used for encryption hasn't been tampered with on their end.
For the points you bring up, at least in the current nerfed extension they aren't really an issue. Key exchange does not happen through the extension or through yahoo, it has to happen out of band. In addition, since this is just the developer preview, AFAIK there is no extension distribution except through github (and so no updates to auto-download). You have to build and install the extension yourself.
Key exchange and extension verification are still two difficult remaining problems, but they are hopefully not insurmountable.
Anyone have any names?
Now, of course, you have to get used to Mutt first :)
Most people want to continue using webmail though. That's why Mailvelope is so awesome. Continue using webmail, but just have an extra button added which opens up an editor with a bit "encrypt" button. Pretty easy, and pretty safe.
I thought that the google thing would be implemented along the lines of the above service. I didn't realise the server still has access to the plaintext as it it composed?