News for hackers. Stuff that matters.

A comment on End-to-End Encryption Plugin for Yahoo Mail.

Re:End-to-End Encryption Plugin for Yahoo Mail by mrb on Sunday March 15, 2015 @07:10PM (#9208631)
Little known fact: Google's End-to-end encryption extension already works on any site. It is not limited to Gmail. In fact it's not limited to webmail either. If a PGP blob is present in a web page, End-to-end can decrypt it. If a text input area is present in a web page, End-to-end can encrypt it.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by runn1ng on Sunday March 15, 2015 @07:24PM (#9208694)
I have no idea how to get that extension or how to install it.

Is there some simple guide?

edit: all I see here

https://github.com/google/end-to-end

is

We’re releasing this code to enable community review; it is not yet ready for general use

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by nacs on Sunday March 15, 2015 @07:30PM (#9208715)
They have a Wiki that has build/install instructions: https://github.com/google/end-to-end/wiki/Build-instructions.

Basically, clone the Git repo then do:

  ./do.sh install_deps
  ./do.sh build_extension
This results in an extension folder that can be installed via Chrome's developer mode.

Disclaimer: not affiliated in any way and never used it myself

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by Fastidious on Monday March 16, 2015 @11:55AM (#9212164)
That is the way I built it. I wanted to add that java is required.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by alkonaut on Monday March 16, 2015 @03:20AM (#9210248)
A Windows build environment is not supported.

Wonder what they thougt there? Windows is where the majority of users are, it's where the people who can't (or don't want to) use command line tools for encryption are.

Why would you even approach this from a Linux-first angle? I'd understand if it was because the developers are typically Linux users and they want it thuroughly tested before shipping a user friendly version (i.e chrome ext for windows).

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by sarciszewski on Monday March 16, 2015 @09:41AM (#9211331)
It's not ready for consumers yet. The end result will be a Chrome extension anyway.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by tim333 on Sunday March 15, 2015 @10:28PM (#9209417)
Interesting that they've had a vulnerability reward program since June 2014. I wonder how that's getting on

http://googleonlinesecurity.blogspot.com/2014/06/making-end-...

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by sondh on Monday March 16, 2015 @01:48AM (#9210048)
They provided an update last December[1] and stated that two rewards have been given. The same update is also interesting because it mentioned the migration from Google Code to Github (three months ago!). The blog post talked about Yahoo! contribution to the project too...

[1] http://googleonlinesecurity.blogspot.com/2014/12/an-update-t...

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by higherpurpose on Monday March 16, 2015 @05:04AM (#9210475)
Yeah, I got the feeling this only works with Yahoo Mail. That's pretty disappointing. Is it really that much harder to make it work across at least the big email providers, while still being able to remove that setting-up the private key and sharing the public key confusion that people get when using PGP? Or is it more of a political/collaboration issue (the big companies don't want to work together on this)?
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by SilasX on Sunday March 15, 2015 @07:53PM (#9208794)
Littler-known fact: if you are serious about protecting that message, then web based email can't really do it.

So long as the server has access to your plaintext as you compose it, the security is compromised and a third party has it. And then if the recipient views the plaintext from a browser...

If you want the email to be secret, it must be in it's encrypted form before the browser even knows about it ... but at that point, why not just use a different, well vetted client program for email?

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by magicalist on Sunday March 15, 2015 @10:06PM (#9209322)
It's in an iframe the page has no access to.

(please read about things before taking it on yourself to educate others...)

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by SilasX on Monday March 16, 2015 @12:20AM (#9209838)
Sure, so long as a) the extension uses a sandboxed one, and b) you can assume your browser and c) extension implementation don't leak iframe information.

It just seems like an unnecessary and avoidable risk.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by magicalist on Monday March 16, 2015 @03:44AM (#9210279)
It's a cross-domain iframe, so there is no access to it by the page.

Security is subject to browser exploits, that's true, but that has nothing to do with what you were saying above.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by utnick on Sunday March 15, 2015 @09:36PM (#9209206)
The way these end to end plugins work, the website never has access to the plaintext message, it all goes through your browser extension first.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by hurin on Monday March 16, 2015 @12:58AM (#9209946)
What GP is saying is not directly correct, but if the third-party service is compromised they could force you to leak the unencrypted message?

More than that if the third-party service is compromised they can MiTM your encrypted communications anyways.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by magicalist on Monday March 16, 2015 @03:46AM (#9210286)
No, it's encrypted client-side in the extension. A MITM would only see the already encrypted message that your email provider would have seen.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by hurin on Monday March 16, 2015 @04:11AM (#9210353)
That wasn't the point I was making - you're still relying on Yahoo providing the public key which corresponds to a given email-address, nothing prevents Yahoo (or whichever third-party service you use) from decoding your messages under those conditions.

You're also relying that the third-party extension used for encryption hasn't been tampered with on their end.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by magicalist on Monday March 16, 2015 @04:34AM (#9210411)
Sorry, I may have misunderstood based on which kind of MITM you were talking about here :)

For the points you bring up, at least in the current nerfed extension they aren't really an issue. Key exchange does not happen through the extension or through yahoo, it has to happen out of band. In addition, since this is just the developer preview, AFAIK there is no extension distribution except through github (and so no updates to auto-download). You have to build and install the extension yourself.

Key exchange and extension verification are still two difficult remaining problems, but they are hopefully not insurmountable.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by EC1 on Sunday March 15, 2015 @07:55PM (#9208804)
> but at that point, why not just use a different, well vetted client program for email?

Anyone have any names?

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by barnaby on Sunday March 15, 2015 @11:30PM (#9209656)
Whiteout.io is a chrome app for email, plus an android app with key-synch between the two. It's still early stages, so it has some issues (like indexing all your emails, since forever, and overheating your computer). But it's very promising.

Most people want to continue using webmail though. That's why Mailvelope is so awesome. Continue using webmail, but just have an extra button added which opens up an editor with a bit "encrypt" button. Pretty easy, and pretty safe.

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by owly on Monday March 16, 2015 @07:53AM (#9210920)
There's also protonmail.ch tutanota.de and several others in early stages.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by moe on Sunday March 15, 2015 @08:05PM (#9208834)
Mutt and Thunderbird come to mind.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by ekianjo on Sunday March 15, 2015 @09:28PM (#9209178)
Clawsmail as well :)
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by jvehent on Sunday March 15, 2015 @08:40PM (#9208939)
GPG in Mutt is fantastically well integrated.

Now, of course, you have to get used to Mutt first :)

[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by middleclick on Sunday March 15, 2015 @10:24PM (#9209401)
Thunderbird with Enigmial also works quite well. I use it everyday.
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by progress on Monday March 16, 2015 @02:09AM (#9210102)
Because it's hard to MITM that :P
[ Parent | on HN ]
Re:End-to-End Encryption Plugin for Yahoo Mail by throwawayaway on Sunday March 15, 2015 @08:22PM (#9208888)
https://crypto.cat/

I thought that the google thing would be implemented along the lines of the above service. I didn't realise the server still has access to the plaintext as it it composed?

[ Parent | on HN ]