Show HN: gpgsend.com - encrypted emails from your browser.

by shocks • 15 years ago

26 19 15 years ago

the-kenny• 15 years ago

Looks like it doesn't respect additional UIDs. I have one uid for my @googlemail address and one for my @gmail address. I can't send to @googlemail using your tool.

shocks8• 15 years ago

Ah thanks for that, I'm working on a patch now! :)

mtogo• 15 years ago

| What about SSL?

| SSL will not be helpful here, since no sensitive information is ever sent to this server. All encryption is done BEFORE it leaves your computer!

This made me cry.

And that's not even mentioning that I'm typing a possibly sensitive message into your app and just hoping that you're going to encrypt it with the right key and not read it yourself.

shocks8• 15 years ago

Heh, yeah I guess you are right. Getting an SSL certificate now. Not sure what to do about "proving" I'm not doing anything untoward with the message?

tptacek2• 15 years ago

You really can't, but that unfortunately doesn't make it not an issue.

Kenan• 15 years ago

The title should link back to the home page. Other than that, great job!

shocks8• 15 years ago

Updated. Thanks for the feedback, greatly appreciated. Cheers!

tresta• 15 years ago

This should really be ssl enabled.

Not only because of the risk of data being intercepted when sent to the server, but also to mitigate the risk of a MITM attack.

shocks8• 15 years ago

Applying for an SSL certificate now. Thanks for your feedback! :)

codecaine2• 15 years ago

did you do the JS implementation of PGP yourself? Really cool service btw. Maybe you could write up a nopaste-tool which encrypts the stored contents before they get posted to your server.

shocks8• 15 years ago

I actually use the Javascript PGP implementation found here: http://www.hanewin.net/encrypt/ but I do plan to implement my own soon. I'm hoping to add a file encryption utility too, but I don't think the current PGP implementation will allow that so easily.

I'm not quite sure I understand what you mean by a nopaste-tool?

Thanks for your feedback! :)

codecaine2• 15 years ago

I don't know what the term for those sites is. Something like http://nopaste.info/. How do you plan to implement file encryption in JS?

mullr• 15 years ago

The first, second, and really all the rules of encryption are that you should not write your own encryption code. And as others have noted, there are fundamental issues with doing such an implementation in Javascript at all.

Please consider the social consequences of pushing encryption which is very likely to be flawed to those who may not know better. If you wish to play (and who doesn't?), then it should be done among people who study cryptography and its implementation for a living.

jannes2• 15 years ago

http://www.matasano.com/articles/javascript-cryptography/

shocks8• 15 years ago

Thanks for the link, a very interesting read. I've been brainstorming some solutions with a friend and we think that perhaps the problem could present an interesting research project. The idea of digitally signed and verified Javascript, maybe a browser plugin to check these signatures, etc.

jannes2• 15 years ago

That's an interesting idea, but you still have the problem that essentially everything in the browser can be MITMed. Even SSL isn't really secure. Just look at the recent CA incidents or the BEAST exploit.

Show HN: gpgsend.com - encrypted emails from your browser.

Related Stories