OHAI, Dnia środa, 4 czerwca 2014 00:19:43 piszesz:

...

not sure what to think about this one: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encrypt ion-easier-to.html

Technical specs: https://code.google.com/p/end-to-end/

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which the US government won't try to trample upon.

If one wants to go crypto, he goes all the way with OpenBSD, Tails, Kali, Gentoo, Firefox, Midori or even old and good Lynx, but not Chrome.

lol

A heck with it, why not -- I'll play the Google's advocate here. So, the extension itself will be FLOSS, as I understand, so the extension itself will be audit-able (inb4 openssl, truecrypt). And as I understand it *will* be installable in Chromium too. Is that an acceptable combination? With such an assumption ("use Chromium, Luke!"), does End-to-End seem to make sense? Or are there other problems we need to look into and be wary of? -- Pozdr rysiek

On 6/3/2014 18:42, tpb-crypto@laposte.net wrote:

...

Message du 04/06/14 00:29 De : "rysiek"

OHAI,

Dnia środa, 4 czerwca 2014 00:19:43 piszesz:

...

...

not sure what to think about this one: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encrypt ion-easier-to.html

Technical specs: https://code.google.com/p/end-to-end/

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which the US government won't try to trample upon.

If one wants to go crypto, he goes all the way with OpenBSD, Tails, Kali, Gentoo, Firefox, Midori or even old and good Lynx, but not Chrome.

lol

A heck with it, why not -- I'll play the Google's advocate here.

So, the extension itself will be FLOSS, as I understand, so the extension itself will be audit-able (inb4 openssl, truecrypt). And as I understand it *will* be installable in Chromium too.

Is that an acceptable combination? With such an assumption ("use Chromium, Luke!"), does End-to-End seem to make sense? Or are there other problems we need to look into and be wary of?

With chromium, End-to-End can start looking respectable. But even then Chromium is cranked by a much smaller team than Firefox and surely suffers from the same problems OpenSSL has faced for most of its existence.

I went ahead and tried it out. One click to make a key and it integrates into gmail. It's not going to replace PGP for anyone who already has a key pair, but making end-to-end encryption one-click-easy is a shoe in the door for getting the public to start caring about its own privacy (and hence ours).

On 6/3/2014 20:08, rysiek wrote:

Dnia wtorek, 3 czerwca 2014 19:55:16 James Murphy pisze:

...

...

...

Message du 04/06/14 00:29 De : "rysiek"

OHAI,

Dnia środa, 4 czerwca 2014 00:19:43 piszesz:

...

...

not sure what to think about this one: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encr ypt ion-easier-to.html

Technical specs: https://code.google.com/p/end-to-end/

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which the US government won't try to trample upon.

If one wants to go crypto, he goes all the way with OpenBSD, Tails, Kali, Gentoo, Firefox, Midori or even old and good Lynx, but not Chrome.

lol

A heck with it, why not -- I'll play the Google's advocate here.

So, the extension itself will be FLOSS, as I understand, so the extension itself will be audit-able (inb4 openssl, truecrypt). And as I understand it *will* be installable in Chromium too.

Is that an acceptable combination? With such an assumption ("use Chromium, Luke!"), does End-to-End seem to make sense? Or are there other problems we need to look into and be wary of?

With chromium, End-to-End can start looking respectable. But even then Chromium is cranked by a much smaller team than Firefox and surely suffers from the same problems OpenSSL has faced for most of its existence. I went ahead and tried it out. One click to make a key and it integrates into gmail. It's not going to replace PGP for anyone who already has a key pair, but making end-to-end encryption one-click-easy is a shoe in

On 6/3/2014 18:42, tpb-crypto@laposte.net wrote: the door for getting the public to start caring about its own privacy (and hence ours).

Okay, but how does that play with other PGP users? For example, will I be able to verify your signature with my "old" GPG?

It imported my ascii armored RSA public key just fine. Upon testing, it correctly sent a signed and encrypted message to my RSA key's associated email. I was not able to verify the signature though since gpg doesn't support elliptic curve keys (I wonder why not). Presumably (hopefully) gpg will be adding EC support in the future and this will no longer be an issue.

On 6/3/2014 22:10, The Doctor wrote:

On 06/03/2014 06:06 PM, James Murphy wrote:

...

email. I was not able to verify the signature though since gpg doesn't support elliptic curve keys (I wonder why not). Presumably (hopefully) gpg will be adding EC support in the future and this will no longer be an issue.

I did a little looking around, and found the following:

http://www.mail-archive.com/gnupg-users@gnupg.org/msg20573.html

Supposedly it was merged into the v2 source tree a few years ago:

https://code.google.com/p/gnupg-ecc/

It seems that at least some of the development builds incorporate ECC in --expert mode. I just tried it on my standard install (GnuPG v2.0.22 (64-bit)) on a new user, and saw no signs of ECC support. This says that it's in the v2.1.x source tree, which is probably why I don't have it:

https://superuser.com/questions/623090/how-can-i-use-gnupg-with-ecdsa-keys

What release of GnuPG do you normally use?

On this machine I'm using gpg (GnuPG) 2.0.22 (Gpg4win 2.2.1) libgcrypt 1.5.3 I never noticed the two '?'s in the supported algos before. Supported algorithms: Pubkey: RSA, ELG, DSA, ?, ? Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Perhaps they are ECDSA and ECDH. In any case gpg --expert --gen-key doesn't give the option for elliptic curve keys. I guess this is a developer branch only feature for now.

On Wed, 04 Jun 2014 18:07:58 -0700 The Doctor wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

On 06/04/2014 06:57 AM, James Murphy wrote:

...

I never noticed the two '?'s in the supported algos before.

An interesting observation.

...

Supported algorithms: Pubkey: RSA, ELG, DSA, ?, ?

Here's what I have in the same place:

Pubkey: RSA, ELG, DSA, ECC, ?

mine says : RSA, ELG, NSA, DSA, ECC, ?

Message du 04/06/14 02:01 De : "James Murphy"

On 6/3/2014 18:42, tpb-crypto@laposte.net wrote:

...

...

Message du 04/06/14 00:29 De : "rysiek"

OHAI,

Dnia środa, 4 czerwca 2014 00:19:43 piszesz:

...

...

not sure what to think about this one: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encrypt ion-easier-to.html

Technical specs: https://code.google.com/p/end-to-end/

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which the US government won't try to trample upon.

If one wants to go crypto, he goes all the way with OpenBSD, Tails, Kali, Gentoo, Firefox, Midori or even old and good Lynx, but not Chrome.

lol

A heck with it, why not -- I'll play the Google's advocate here.

So, the extension itself will be FLOSS, as I understand, so the extension itself will be audit-able (inb4 openssl, truecrypt). And as I understand it *will* be installable in Chromium too.

Is that an acceptable combination? With such an assumption ("use Chromium, Luke!"), does End-to-End seem to make sense? Or are there other problems we need to look into and be wary of?

With chromium, End-to-End can start looking respectable. But even then Chromium is cranked by a much smaller team than Firefox and surely suffers from the same problems OpenSSL has faced for most of its existence.

I went ahead and tried it out. One click to make a key and it integrates into gmail. It's not going to replace PGP for anyone who already has a key pair, but making end-to-end encryption one-click-easy is a shoe in the door for getting the public to start caring about its own privacy (and hence ours).

I find the combination of gmail and chromium while thinking in privacy a risible solution. But hey, it may help grandma think about protecting herself, ok. False sense of security is the best we can hope at this point. That's sad, man.

On Wed, Jun 4, 2014, at 10:19 AM, tpb-crypto@laposte.net wrote:

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which the US government won't try to trample upon.

Someone's already submitted a bug report: https://code.google.com/p/end-to-end/issues/detail?id=9 Alfie -- Alfie John alfiej@fastmail.fm

On Thu, Jun 5, 2014 at 10:37 AM, Black Fox wrote:

On Thu, Jun 5, 2014 at 4:48 AM, Alfie John wrote:

...

On Wed, Jun 4, 2014, at 10:19 AM, tpb-crypto@laposte.net wrote:

...

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which

the

...

...

US government won't try to trample upon.

Someone's already submitted a bug report:

https://code.google.com/p/end-to-end/issues/detail?id=9

Cute, but the threat model of the submitter seem unclear to me, in what is it different here from gpg binaries provided by a linux distribution package ?

If even only one person have access to the packaging keys and is of american nationality he can receive a National Security Letter and would have to comply (Rubber hose is obviously working too if they want to risk it). Using quantum insert they don't even need to change the packages for everyone, only you.

Updates for any software executing with access to your private data are dangerous.

I don't see why this subject is present in the issue tracker of an extension... it's a lot more general issue (Except for the fact that Google bashing is cool today).

This seems like a good project, that will move PGP usability and standards forward. It's also a big deal for Google to throw its support to the project, since it is in direct tension with the business model Gmail is built on (scanning your emails). The auto-update feature is a big deal that will have to get wrestled with openly as this moves further. Perhaps they'll work out a separate update policy for it, who knows. But it'll also have applications outside of a place in the Chrome Web Store. For example, hopefully much of this work (especially the JS crypto work) will also turn out to be reusable in Firefox. -- konklone.com | @konklone https://twitter.com/konklone

This seems like a good project, that will move PGP usability and standards forward. It's also a big deal for Google to throw its support to the project, since it is in direct tension with the business model Gmail is built on (scanning your emails). The auto-update feature is a big deal that will have to get wrestled with openly as this moves further. Perhaps they'll work out a separate update policy for it, who knows. But it'll also have applications outside of a place in the Chrome Web Store. For example, hopefully much of this work (especially the JS crypto work) will also turn out to be reusable in Firefox. On Thu, Jun 5, 2014 at 6:41 PM, wrote:

...

Message du 05/06/14 04:54 De : "Alfie John"

...

If you want to land on a watch-list and maybe no-fly list, you just install it in your Chrome. Because as far as we can tell Google is in bed with the NSA and so the proprietary browser may just flag you to the system and done you are, or may forward all your messages in the clear. Who knows? Which is worst?

That's why there is not foocking way to trust proprietary software. Companies are forced to act like criminals on behalf of the government. There is no loyalty, respect, ethics, honesty or even business which

On Wed, Jun 4, 2014, at 10:19 AM, tpb-crypto@laposte.net wrote: the

...

US government won't try to trample upon.

Someone's already submitted a bug report:

https://code.google.com/p/end-to-end/issues/detail?id=9

It is interesting to note how this guy brushed the issue aside while clearly not addressing the concern at all, but make-believing it is addressed:

...

#5 evn@google.com Yes, we treat this concern very seriously. I closed it because we aren't auto-updating any extensions (there's no CRX we are shipping that could be auto-updated).

Yeah, they aren't auto-updating extensions, but this doesn't concern other extensions, this concerns the core of the browser itself.

These reactions plus the way we see this "innovation" pushed in the specialized media already is a sure indicator that the backdoor is in place already to trap the fools.

Run this thing and get all your messages stored in the clear, in an obscure datacenter, forever.

-- konklone.com | @konklone https://twitter.com/konklone