Re:Automatically encrypt your Gmail account
by mike-cardwell on Tuesday June 25, 2013 @02:18PM
(#5941383)
http://webpg.org/
If this sort of functionality was standardised, simplified and baked in to the major browsers, we'd be able to build all sorts of wonderful software on top of it.
You lose backend search this way. It's a critical feature.
Re:Automatically encrypt your Gmail account
by methehack on Tuesday June 25, 2013 @03:36PM
(#5941862)
Seems like if you really cared for the contents of a textarea, for instance, you could tokenize the text client side and encrypt each token with the client side private key then you could similarly encrypt the search tokens client side and search serverside not knowing what you were searching for.
However, I take your point. Lots of work, not quite the same. It still seems like the facility should be baked in though so that application's could make the proper tradeoffs.
Re:Automatically encrypt your Gmail account
by michaelt on Tuesday June 25, 2013 @04:34PM
(#5942268)
Products like CipherCloud reportedly work like you suggest. Unfortunately it's not very secure.
If you split the text into words, discard case and encrypt each word, the NSA can just e-mail you a dictionary file, match the line numbers in the dictionary file ciphertext to line numbers in the dictionary file plaintext, and they've got your secret decoder ring (at least for every word in the dictionary file).
Re:Automatically encrypt your Gmail account
by arjunnarayan on Tuesday June 25, 2013 @04:04PM
(#5942055)
Seems super vulnerable to frequency analysis though. However, if this is a path you might want to go down, you might want to look at CryptDB, a research project that looks at keeping a server side encrypted database and allows for queries in a principled way: http://css.csail.mit.edu/cryptdb/
This is where we really need fully homomorphic encryption!
Something like text search should only need partially-homomorphic encryption. For example: encrypt each byte with the same key. Then to search, encrypt the bytes of your search term and send them to the backend. It should be able to find them without knowing what your search term was. There are issues with this exact scheme of course but you get the idea!
There is some research in this area, e.g. http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf
Mailvelope is another client-side browser extension that uses OpenPGP.js to encrypt email that works with gmail, outlook.com, Y! mail:
The general facility of client side private key encryption before form submission of both text fields, areas, and files seems like it would be very useful. Not sure why that's not planned for, say, html5. Odds are I'm sprinkling my own ignorance all over this :)