Show HN: Cypht – Unique Open Source Webmail

Re:Show HN: Cypht – Unique Open Source Webmail by mike-cardwell on Wednesday October 05, 2016 @04:34AM (#12642352)

I can't find any mention of PGP anywhere on the site. That it is supported, or in-development, or planned. Which is a shame, because there are good Webmail implementations out there with PGP support. Roundcube via plugins, Rainloop built in.

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by jasonmunro on Wednesday October 05, 2016 @09:48AM (#12643738)

We have an open issue at github for PGP support, and it's something I definitely want to pursue. The big concern is private key security and how to balance that with usability.

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by fak3r on Wednesday October 05, 2016 @11:01AM (#12644370)

Is there a way to hook into keybase? https://keybase.io/ This project looks great, I use Fastmail but would like to have an IMAP web front end I host (I used to host my own stack), so I may give this a go. Thanks for sharing it!

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by scandox on Wednesday October 05, 2016 @10:23AM (#12644032)

I would love this. Appreciate it isn't simple. Keep up the good work.

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by stephenr on Thursday October 06, 2016 @04:18AM (#12650942)

Any chance that/another issue would cover s/mime?

Many mainstream (read: Apple/Microsoft) mail clients need plugins (which eg on iOS aren't an option) for PGP Mail, but S/MIME is handled out of the box.

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by therealidiot on Wednesday October 05, 2016 @05:19AM (#12642534)

Don't these typically require access to the private key though?

I'm not comfortable uploading my private key to a webmail server, even when its my own server

[ Parent | on HN ]

Re:Show HN: Cypht – Unique Open Source Webmail by mike-cardwell on Wednesday October 05, 2016 @05:43AM (#12642616)

> Don't these typically require access to the private key though?

Yes, but not on the server. The key is typically stored encrypted in the browser storage. Never hits the server.

But there is still the problem where the server could send "bad" javascript which copies the key and uploads to the server.

However, if it's my server and I'm running the webmail, I might be ok with that. And if the server is being run by somebody I trust, I might still be ok with making that decision.

And even if I don't want to add my own private key, it would still be nice if the webmail could verify messages signed by other people. There's nothing risky about that.

[ Parent | on HN ]