[GNU/consensus] PGP Mail Client in the Browser

[Per Guth]

Hello,

I think this constitutes quite a huge leap forward in terms of
usability. Basically they combined open source javascript libraries for
IMAP, TLS and OpenPGP to form a client side browser based email client
that is capable of making e2e encrypted mailing charmingly easy. That
combined with the state of the art UI from https://github.com/nylas/N1
would be terrific!


# Whiteout.io

[Whiteout.io](https://github.com/whiteout-io/mail-html5) **HTML5 mail
App** with integrated OpenPGP encryption from Munich, Germany. Usable
as a **chrome extension**, **mobile phone app** or **self-hosted**
(Node.js). They also offer free and paid [managed
mailboxed](https://whiteout.io/). The code has undergone a **full
security audit** of their sourcecode by Cure53.

Using JavaScript Whiteout will establish a **encrypted end-to-end
connection** from you browser/the app/the extension **to the IMAP
server**.

Keys can easily be **generated (2048 bit)** on the client, **imported,
exported and revoked**. Users have the option to use a **encrypted
private key sync** if they conveniently want to use the same key on
multiple devices. Whiteout will **transparently search for public
keys** of peers by querying common public key servers. Sent encrypted
mails are encrypted to self before they get saved to `Sent`.


# OpenPGP.js

A **pure Javascript** implementation of the OpenPGP protocol:
[OpenPGP.js](http://openpgpjs.org/). Only supports browsers that
implement `window.crypto.getRandomValues`. Code base has undergone
**two complete security audits** from [Cure53](https://cure53.de/).


Viele Gruesse,
Per

***

In another exchange leaked [...], Zuckerberg explained to a friend that
his control of Facebook gave him access to any information he wanted
[...]:
ZUCK: yea so if you ever need info about anyone at harvard
ZUCK: just ask
ZUCK: i have over 4000 emails, pictures, addresses, sns
FRIEND: what!? how’d you manage that one?
ZUCK: people just submitted it
ZUCK: i don’t know why
ZUCK: they “trust me”
ZUCK: dumb fucks

- http://www.newyorker.com/magazine/2010/09/20/the-face-of-facebook

[carlo von lynX]

Post by Per Guth
Hello,

Hello Per. Sorry for being again on the opposite dimension
of opinionspace. I don't mean to put you down, I just have
a very skeptical look at things...

Post by Per Guth
I think this constitutes quite a huge leap forward in terms of
usability. Basically they combined open source javascript libraries

Wait, first of all the main usability problems of PGP are caused
by SMTP.. therefore changing the UI doesn't address any of those.
I presented about that at http://youbroketheinternet.org/#30c3usability
and collected 15 problems with PGP at http://secushare.org/PGP

By the way, Hartmut, how many of the problems listed on that page
does pEp handle?

Post by Per Guth
for IMAP, TLS and OpenPGP to form a client side browser based email
client that is capable of making e2e encrypted mailing charmingly

Reducing the insecurity of PGP even further... while we should
focus on making metadata resistant mail systems!

Post by Per Guth
easy. That combined with the state of the art UI from
https://github.com/nylas/N1 would be terrific!

Ricochet or Telegram aren't so ugly either. They are written in Qt.

Post by Per Guth
Using JavaScript Whiteout will establish a **encrypted end-to-end
connection** from you browser/the app/the extension **to the IMAP
server**.

Wow.. now that I call whitewashing. Using the terminology "end-to-end"
to mean the connection to the server is really really selling snake
oil to the people. As if servers where the end of anything.

Post by Per Guth
Keys can easily be **generated (2048 bit)** on the client,

Trusting JS code from the server...

Post by Per Guth
**imported, exported and revoked**. Users have the option to use a
**encrypted private key sync** if they conveniently want to use the
same key on multiple devices. Whiteout will **transparently search
for public keys** of peers by querying common public key servers.

Exposing the metadata of communication partners before any mail
has been sent?

Post by Per Guth
Sent encrypted mails are encrypted to self before they get saved to
`Sent`.

What happens with unsent drafts? Thunderbird and Claws both had
the bug of sending them to the IMAP server in the clear.

Post by Per Guth
[OpenPGP.js](http://openpgpjs.org/). Only supports browsers that
implement `window.crypto.getRandomValues`. Code base has undergone
**two complete security audits** from [Cure53](https://cure53.de/).

Too bad that OpenPGP is really really bad for metadata protection.
One implementation was already one too many.