We built this extension to see if it was possible to prevent webmail providers from handing over your email data to other parties. We encrypt the email message on the local machine and also prevent gmail from saving a draft of the email to their servers so they never have a record of the raw email text.
We think the user experience is pretty great - works inside gmail, users need to know nothing about security or keys and you can send to any other gmail user (you don't have to worry if they have the correct software installed).
With any attempt at security and encryption, you usually trade off ease of use with how secure it is. We decided to use symmetric encryption because it made the user experience better. The only downside of course is that the security is only as good as the password the user chooses to encrypt the message with.
- we're using the Stanford javascript crypto library here: http://crypto.stanford.edu/sjcl/
- we open sourced our extension here: https://github.com/StreakYC/StreakSecureGmail
There have been a few other attempts at this, but they usually require users to understand how encryption works and require that all the users you send emails to have signed up for something (or have a public key somewhere). We think our attempt is ridiculously easy to use.
This is a super early experiment/alpha/whatever so we see this as a starting point. Would love to get feedback!
What's the suggested method to securely exchange the key?
It feels a bit like this is a step backwards in many ways. Being a non-webmail user, how can I benefit from this? If this were an implementation of SMIME/GPG it would be more widely adoptable since anyone with a compatible GMail plugin, desktop, or mobile client could use this.
The intention of this isn't to be the most secure solution on the planet - you're not going to be using Gmail if that's the case.
Instead we wanted to build a starting point that was A) easy to use, and B) easy to extend.
Our initial plan was to use a GPG solution, but that introduced a lot of complexity to the UX and also had other security holes. But the main thing is that if something is too complicated, it's not going to be used by the broader masses - kind of like GPG right now.
With this solution only the sender has to have the extension installed to send an encrypted email.
"With this solution only the sender has to have the extension installed to send an encrypted email."
Hmm... but to read the mail, even the receiver needs to have the extension. I don't see much point in advertising "only sender needs the extension" bit.
I think the distinction is that the receiver need not have signed up or installed anything at the time the message is sent. That is, the sender need not worry if the receiver is currently using SecureGmail, they can send the message now and the receiver can install the extension later.
This is a good idea, and looks promising. Running it going on other browsers than Chrome would be nice.
Is there any way of getting it compatible with the Syncdocs program which does local machine encryption of Google Drive files? It looks like Syncdocs does AES256
We think the user experience is pretty great - works inside gmail, users need to know nothing about security or keys and you can send to any other gmail user (you don't have to worry if they have the correct software installed).
With any attempt at security and encryption, you usually trade off ease of use with how secure it is. We decided to use symmetric encryption because it made the user experience better. The only downside of course is that the security is only as good as the password the user chooses to encrypt the message with.
There have been a few other attempts at this, but they usually require users to understand how encryption works and require that all the users you send emails to have signed up for something (or have a public key somewhere). We think our attempt is ridiculously easy to use.This is a super early experiment/alpha/whatever so we see this as a starting point. Would love to get feedback!