

(Simple) Chrome plugin for GPG/PGP in GMail - mh_
http://thinkst.com/tools/cr-gpg/

======
pavpanchekha
Neat idea, and I know it's a cute hack, but

1) You ask for all data on my personal computer and all data on all websites.
What?! I imagine you might require local data access to get my GPG key and
Chrome doesn't allow it more fine-grained than that (but forchrissakes tell me
that on your site), but why all sites? Why not mail.google.com and gmail.com?
Because of apps for your domain?

2) You're providing a crypto product. I want to see your source code, and
don't tell me to unzip/tar/whatever your crx.

~~~
mh_
Link to the src has been added to the site. (sorry we included it when we
mailed the gpg mail list, but didn't add it to the page)

Direct Link: <https://github.com/RC1140/cr-gpg>

------
pnathan
How do you manage your private keys not getting into Javascript land & being
POSTed out to an arbitrary site?

~~~
mh_
We don't store the password in the DOM. When you choose to sign/encrypt, the
password is passed to gpg (via the plugin) and promptly goes out of scope. (It
means you have to enter your password every time you want to sign/encrypt, but
this seems safer)

~~~
pnathan
Goes...out of scope.

I am suspicious that that's not really sufficient password protection. What
protection do you have from an attack that provides access to your machine's
address space? (or chrome's address space)?

I'd like to see the source code before I use this. If that sounds paranoid,
it's because if I'm using crypto, it's because I'm concerned about snoopers.

\--- edit - source got posted. Thanks!

~~~
mh_
-nod- an attack with full access to chromes address space would grab the password in memory.

I'm guessing someone with that sort of threat model isn't using gmail for
comms. (I guess even then, it could be useful to verify signatures (when gmail
doesn't break the mail) without risking your private key)

~~~
caf
Could you mitigate that by having a separate process to do the crypto, which
the plugin talks to by IPC? The separate process is then the one that prompts
for the password.

This would also mean you don't have to reenter your password every time.

------
mh_
The plugin has 2 quick updates: a) It's now site restricted to mail.google.com
b) Will make use of chromes update feature in the future.

Please grab the new version from <http://thinkst.com/tools/cr-gpg/>

