From MAILER-DAEMON Wed Jul 25 15:18:06 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fiPIT-00038p-VN for mharc-esd-translators@fsf.org; Wed, 25 Jul 2018 15:18:06 -0400 Received: from mail.fsf.org ([208.118.235.13]:43167) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fiPIP-00038j-Kj for esd-translators@fsf.org; Wed, 25 Jul 2018 15:18:05 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_PASS, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from mail-wm0-f42.google.com ([74.125.82.42]:53931) by mail.fsf.org with esmtps (TLS-1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fiPIP-00015h-4d for esd-translators@fsf.org; Wed, 25 Jul 2018 15:18:01 -0400 Received: by mail-wm0-f42.google.com with SMTP id s9-v6so7135836wmh.3 for ; Wed, 25 Jul 2018 12:18:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:references:openpgp:autocrypt:subject:message-id:date :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=ud8r0sN4wP9V0qy82AUn5usTbgyFoiAKhpW93Nz7158=; b=Do/dA6684MbdqUzpf50s4YI34sYmiE4Sb1EptWqO/ROMU5DfGvODVfoYkxGg0zpaDB +bNSjN1ej65uNCMN15LJA7CN8kGFXDrqLLTnbFFz4lqgtY4C834L/8UeSZhpYnIDzPjq uTkDil8/vihPmTw9lnmBXTs5NZYdS2r/IuZzBVWYry2c9N8pUuPJUKqOnUY9zJnZ4tz6 1zq+98AFBCN8cMBn1EdGnajDiTPL9RmMoCFvMrsnbVtgYQRnORjQFKgd+qyN83a6bCqK bk0UE5+Ck5giTEXGFbG8pPthzZ9Sfeg6gy6oBh6t2LUpUBhOOmd67FdW10aRLsku00iy vddg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:references:openpgp:autocrypt:subject :message-id:date:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=ud8r0sN4wP9V0qy82AUn5usTbgyFoiAKhpW93Nz7158=; b=BNop0D+K4h1UATym/YmcWD7zMCpPSl27khYswdkOYCZGen7G0VgH+YVft9X8v3wl8J XqtR2D/0+Q3fHPS+myqEav5kbE+21QQwMK2MiRTguSHnUPb6vEsbVQhm806RJIIzAw9f arNud4dbIXo6ALgElKLA3KgijDe1DJQSXRKXuuCx6mlV2yQbpMYyM6CZaGDPZYnnpDnO jrGjLH0ZVcUZiU5fI9OFWpZOt8f/mureQMPeytVe0EeiIqb3U++UR8c8kCKBac4He7Rc 7R5jCXpPnysW3Cd1DEjErVfs0wsS77yr2XGvHo1u1YpUQ9v4FxZnT1ks4CmbJ2twZdY/ dX0A== X-Gm-Message-State: AOUpUlF4WpWezWbj81ljuBmnLBLx+v9nZifOJhj4BgBdwV88k8geFbfS Pl+Y+ykMTNTTOsnVRiKsrnX752+k X-Google-Smtp-Source: AAOMgpdBto5h1K0zCl1lJl5G5j/RFsfn0COhXxxWrQcCJvr9sAKMkcZ0ErJsm9wdh91aa4+sfZNt9Q== X-Received: by 2002:a1c:4c0e:: with SMTP id z14-v6mr5812265wmf.89.1532546278812; Wed, 25 Jul 2018 12:17:58 -0700 (PDT) Received: from [127.0.0.1] ([141.255.162.34]) by smtp.gmail.com with ESMTPSA id e133-v6sm9784496wma.33.2018.07.25.12.17.55 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 25 Jul 2018 12:17:57 -0700 (PDT) From: Tomas Stary To: esd-translators@fsf.org References: Openpgp: preference=signencrypt Autocrypt: addr=tomichec@gmail.com; prefer-encrypt=mutual; keydata= xsBNBFMCNhABCADy6MES/DD7lUFk14wC5xOd6r7aa1s6vZMjAtSueTluOWHYjMNT8cvrSXoz pqrlgfWDUre2p0vFbNxZAfePboltVcyUNjO7eKpPtjhhxYWHFYFY9qNjYipX1RwHA1xaKRPy bqcNgvuQxBdw0R6TZu7m1wS6cC0GIUyWQLyZGygg3gyIdzhYeUmUfLvcmvTMSRsxEWgjo5ZI c4+2lYdh/YQbYhqO86O6h5ZtYOYcZPRlvTJfikMJyB/dDUhVI46qHE/olMG8s6z1D8D9GQIB uCJ6GhQnGbst+Mg2XD2UjDVwFnKrIJqrDpmGKbiYM5dxdT9XwH35Q5aaIp1stndVompvABEB AAHNIFRvbWFzIFN0YXJ5IDx0b21pY2hlY0BnbWFpbC5jb20+wsB/BBMBAgApAhsDBwsJCAcD AgEGFQgCCQoLBBYCAwECHgECF4AFAlltBKwFCQotNZwACgkQNP6tNcbMStZCZggAww35scLy 2HfJlOwMm0cn1XPaglQXup3poE0BdSq/RBk9JHt+NMRbMG2x6bJ+m6OCIXmsSULsp4xfzeQb SMBeOT9YSD26wr1vl/90B1qK7jXvMyM3lOEvHzXEgO64cifzs0N2Fb6JMoOqZor4vsK02BeE Qyy1QuI3RG2IeVLOB75iEPVwiJ7o7tUNmiXdugup1A9TJ4LNJd+KK6xH9EZLhGvy9efwlJba z4/rZKlRwvr3hxRcP2xtjJC/VLwTgaihdtuH/vMfAKpFxxIChqfoVyHDkezNUtLpjOD0oBWa ArOrgAncsSlBUQHeUEb4B3oVgPpacSFkNIlPgSRJEf77Os7ATQRTAjYQAQgA5qB9byhX8yNC YZRjoTOnc7F/vF3nVAIM4uDbPYhpMl3U++/RUXl5ZsNZMAx1PiE5ifeVbEzpYKX91PgC6kdO 4WqxcZzOLgezOgjECppB6QNysOYduqeVYz16fU1Ym8mFwPGoubQm8rX9lNp8Qm78Hg1ekBQX xxhIT6k/AjP52S8Kyd2CHdul7BsvLsRUeuREqX/j3Fmj3NiFNqxD7LEfVilIBSs7VIP68X5S cF0YpWcI1XY/URDPutfFsLYaE3+Fl0dL3+Az83hMH+K6a8hh5H/aNQxxwdYm8Ke625snV5yx Qe6dtwuqdK8wxIjXMMn7Vi1lxg70BoBWMZWcNVuIkQARAQABwsBlBBgBAgAPAhsMBQJZbQUm BQkKLTYWAAoJEDT+rTXGzErWo9kIAJzF7GInXolu0FNA9DasvRRz0aDINw5i+Lvl08PsI9v+ YUVA/bEJuCo2uMhDys3Vk9NSjv3+X/lg84PBj+2R6j+GcM0X//H6T4osfzawr9Pwiroov7yT EHCaX+zGf5JRfvyQfRcDgDJx1KtfCwKbOJ/aieAkheF53z5dUiIO4tieHGCvZWpvXg1z1c/+ bFRW9zfVuWeo/ysD/8vJpPgY+oaZFnYf3hGy4m4p1yl8kvgcCvpx8nGDwVY4tsXOkBzaGwzD xCgvUaDg49MG4eFGn3ieVtcdMxgTkJJaL4MHwsaeUT37FTa5zkwtdECwr50xFJq3Uwf70fws O9X7ghy+Ut8= Message-ID: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> Date: Wed, 25 Jul 2018 21:17:52 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] Subject: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jul 2018 19:18:05 -0000 Hi people, It has been brought to my attention, that many of my friends use webmail. The concept of an email client is slowly becoming obsolete. When I send the link to ESD website to one of my friends, she replied: """ I tried to activate mail encryption, but from add-ons on my gmail, there is no option for "Enigmail", as described on the website you sent to me. """ Trying to teach those people about email clients besides of teaching them encryption would only add to their confusion. However, I have recently found the mailvelope browser extension (for firefox and chrome), which integrates the encryption in webmail. https://www.mailvelope.com/ They have pretty good documentation on the website, but it is only in English, German and Japanese. What is your opinion on (1) mailvelope as such (2) including a manual to mailvelope to ESD website? Best, T. Tomas Stary: > Hi everyone, > > I've noticed that the new version (2.0.2) of Enigmail sets up Pretty > Easy Privacy (pEp) [1] to all new users by default. > > The pEp automatically generates a keypair for all the accounts in > Thunderbird and attaches the public key to all outgoing emails. It > doesn't use keyservers. Instead it advises users to verify the keys > fingerprints via other communication medium (i.e. phone call, physical > contact). When the certificate is about to expire it generates a new key > and starts attaching the new pubkey again. > > Also, all outgoing emails to addresses with a known key are encrypted > and signed. A status of the communication integrity is shown based on > the traffic-light colours. > > Another interesting feature is the possibility to securely transfer the > private key to another connected device (phone, tablet) using the email > server as temporary storage of the encrypted private key. > > There are some questionable changes as well. For instance, the password > is not required to encrypt the key localy, so anyone with the access to > the key can use it directly without the need to enter a password. > Although, the possibility to set up one is there. > > Has any of you tested pEp already? Should we update the guide to reflect > this change? > > [1] https://prettyeasyprivacy.com/docs/index.html > > T. > From MAILER-DAEMON Thu Jul 26 13:54:36 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fikTE-0002AZ-Gz for mharc-esd-translators@fsf.org; Thu, 26 Jul 2018 13:54:36 -0400 Received: from mail.fsf.org ([208.118.235.13]:44419) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fikTC-0002AT-03 for esd-translators@fsf.org; Thu, 26 Jul 2018 13:54:34 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([208.118.235.10]:52561) by mail.fsf.org with esmtps (TLS-1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fikTB-0004jl-J2 for esd-translators@fsf.org; Thu, 26 Jul 2018 13:54:33 -0400 Received: from ineiev by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1fikTB-0006jZ-3G; Thu, 26 Jul 2018 13:54:33 -0400 Date: Thu, 26 Jul 2018 13:54:33 -0400 From: Ineiev To: Tomas Stary Message-ID: <20180726175432.GB17905@gnu.org> References: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gpXIsXW0UVH8BryT" Content-Disposition: inline In-Reply-To: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] Cc: esd-translators@fsf.org Subject: Re: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jul 2018 17:54:35 -0000 --gpXIsXW0UVH8BryT Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, Tomas; On Wed, Jul 25, 2018 at 09:17:52PM +0200, Tomas Stary wrote: >=20 > It has been brought to my attention, that many of my friends use > webmail. The concept of an email client is slowly becoming obsolete. Some experts say email becomes obsolete... but I'm going to use it, anyway. > Trying to teach those people about email clients besides of teaching > them encryption would only add to their confusion. Then they could try other communications (not email). > However, I have > recently found the mailvelope browser extension (for firefox and > chrome), which integrates the encryption in webmail. >=20 > https://www.mailvelope.com/ I'm sceptical about any cryptography with webmail, https://secushare.org/end2end I think it isn't just impossible---it's very impossible to get it right. --gpXIsXW0UVH8BryT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEvZ1N7nsv8cvvLuDE4KzT4Mvnh0oFAltaCtgACgkQ4KzT4Mvn h0pgjggAjEHZYruKNF3aLpdfD+x4Y5lO1PFNBkV38I+4b2k/CaTIlgave5nxaIVJ m6+rInLvQPip4Qs52NSqy5fHKMZ5lfJcufmN2O4e9+vg9Meo61pvtoXc7SWiPzFw rpcgach9A41tYTX8ik5Q7/2BxaIW0hCsA+UUYlVCkgnq+lNLGqaotUGadXb/pjQP zQNt1pdyUeK3KNnw/fb09VOG1eW5GXyH0Oma1lkYPapNRAkwW8GodQ3hfO4d5Nj1 sPolFZzYZw3vK9SQtlqSz1/8wXL8j1G7soGcDn+D54SBaq6tpzIrDBUhca5uhTGe D+3btPK+UV/Jjd+G63YaFLjYM0whxQ== =7Dw+ -----END PGP SIGNATURE----- --gpXIsXW0UVH8BryT-- From MAILER-DAEMON Thu Jul 26 18:55:14 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fipA9-0002pm-OE for mharc-esd-translators@fsf.org; Thu, 26 Jul 2018 18:55:13 -0400 Received: from mail.fsf.org ([208.118.235.13]:34303) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fipA4-0002pZ-Fy for esd-translators@fsf.org; Thu, 26 Jul 2018 18:55:12 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_PASS, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from mail-wm0-f67.google.com ([74.125.82.67]:39353) by mail.fsf.org with esmtps (TLS-1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fipA4-0001ml-0s for esd-translators@fsf.org; Thu, 26 Jul 2018 18:55:08 -0400 Received: by mail-wm0-f67.google.com with SMTP id h20-v6so3524438wmb.4 for ; Thu, 26 Jul 2018 15:55:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:cc:references:from:openpgp:autocrypt:subject:message-id:date :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=srUjFzCxR9oAjLSDAf1ygEFbfAfa49b6jRQXPlOcz8I=; b=hS8KIB438z8WX1J6LaVdviT4a89UumcvUo6/G8awWi/pLKVQYaLCtLRYAZTkWvYeIg 1Kw19vbo+7pnEyUPTntQmaCCA9Ye0P94AsU/htCf7IbS4OGOrRCNPOxU8BSgS85NeH8J aTJHWEZwYqXBHCPaUmcO/2mi/DGbHZa9Wy1QS/WeBbaT+Z6TLtNMvHWYR569Jfn3WfKN cOc55Rfi48IrUTal+9BAj9rznyCeh0mte2M9Yw9Fi4fBoz1SZ7WWOYT2HmTka8uxm1dZ vXHADNBMmAw2eAWc2KeERcmfrK0ACYSVvqFrhIPEdJtAF4jexY7iPD7vKHNfO9TECpSJ gzhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:cc:references:from:openpgp:autocrypt:subject :message-id:date:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=srUjFzCxR9oAjLSDAf1ygEFbfAfa49b6jRQXPlOcz8I=; b=W7dCFDUttfr/FJgFV+piwW2cr/htwzVV/9cMyVeSRd/fmkLFYUei78kjLBe6gEa1Bl yqpK1CjFDyc461kUsKsJKXPflEckQV3xcyigyzFEz5vNXGHg0hbVteDZtyH4v0wuglpV zBkbxS2UhDvxZQ/EUmTRdGQNhoqyz6+mgW+M6ScJBu5wgEvC3aa51+cn/CcT+Rgy2mki sDI7xQWwupbwmjAzUNmrGh902NzJraoS7SQZaPooCx20AOE3Tz8ASWjqoZ1vsoMLqJxC qyzfVI0Fzlo5MrnejCish6OXA7wf+VCQh1g8nA7ycxlS8z9yun59wdcFg4vzhMpnPsZP UTJQ== X-Gm-Message-State: AOUpUlE5LEy7CLYQ07rX3oEYBkD9omzd12wyRkIlCEDS3TByNP3wEMCF BAJw+70/r6Bbpgt/FMF94mdOu+yd X-Google-Smtp-Source: AAOMgpe1VetFHlJY3hmfj25e+NdHhbXloqYMaH91LEj9XT0UUwrqPDCZCLKHiJlp1ys0pWEqsovesw== X-Received: by 2002:a1c:c912:: with SMTP id f18-v6mr2809298wmb.73.1532645703421; Thu, 26 Jul 2018 15:55:03 -0700 (PDT) Received: from [127.0.0.1] (exit01.brasshorncomms.uk. [185.104.120.7]) by smtp.gmail.com with ESMTPSA id d15-v6sm664658wmb.0.2018.07.26.15.55.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 26 Jul 2018 15:55:02 -0700 (PDT) To: Ineiev References: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> <20180726175432.GB17905@gnu.org> From: Tomas Stary Openpgp: preference=signencrypt Autocrypt: addr=tomichec@gmail.com; prefer-encrypt=mutual; keydata= xsBNBFMCNhABCADy6MES/DD7lUFk14wC5xOd6r7aa1s6vZMjAtSueTluOWHYjMNT8cvrSXoz pqrlgfWDUre2p0vFbNxZAfePboltVcyUNjO7eKpPtjhhxYWHFYFY9qNjYipX1RwHA1xaKRPy bqcNgvuQxBdw0R6TZu7m1wS6cC0GIUyWQLyZGygg3gyIdzhYeUmUfLvcmvTMSRsxEWgjo5ZI c4+2lYdh/YQbYhqO86O6h5ZtYOYcZPRlvTJfikMJyB/dDUhVI46qHE/olMG8s6z1D8D9GQIB uCJ6GhQnGbst+Mg2XD2UjDVwFnKrIJqrDpmGKbiYM5dxdT9XwH35Q5aaIp1stndVompvABEB AAHNIFRvbWFzIFN0YXJ5IDx0b21pY2hlY0BnbWFpbC5jb20+wsB/BBMBAgApAhsDBwsJCAcD AgEGFQgCCQoLBBYCAwECHgECF4AFAlltBKwFCQotNZwACgkQNP6tNcbMStZCZggAww35scLy 2HfJlOwMm0cn1XPaglQXup3poE0BdSq/RBk9JHt+NMRbMG2x6bJ+m6OCIXmsSULsp4xfzeQb SMBeOT9YSD26wr1vl/90B1qK7jXvMyM3lOEvHzXEgO64cifzs0N2Fb6JMoOqZor4vsK02BeE Qyy1QuI3RG2IeVLOB75iEPVwiJ7o7tUNmiXdugup1A9TJ4LNJd+KK6xH9EZLhGvy9efwlJba z4/rZKlRwvr3hxRcP2xtjJC/VLwTgaihdtuH/vMfAKpFxxIChqfoVyHDkezNUtLpjOD0oBWa ArOrgAncsSlBUQHeUEb4B3oVgPpacSFkNIlPgSRJEf77Os7ATQRTAjYQAQgA5qB9byhX8yNC YZRjoTOnc7F/vF3nVAIM4uDbPYhpMl3U++/RUXl5ZsNZMAx1PiE5ifeVbEzpYKX91PgC6kdO 4WqxcZzOLgezOgjECppB6QNysOYduqeVYz16fU1Ym8mFwPGoubQm8rX9lNp8Qm78Hg1ekBQX xxhIT6k/AjP52S8Kyd2CHdul7BsvLsRUeuREqX/j3Fmj3NiFNqxD7LEfVilIBSs7VIP68X5S cF0YpWcI1XY/URDPutfFsLYaE3+Fl0dL3+Az83hMH+K6a8hh5H/aNQxxwdYm8Ke625snV5yx Qe6dtwuqdK8wxIjXMMn7Vi1lxg70BoBWMZWcNVuIkQARAQABwsBlBBgBAgAPAhsMBQJZbQUm BQkKLTYWAAoJEDT+rTXGzErWo9kIAJzF7GInXolu0FNA9DasvRRz0aDINw5i+Lvl08PsI9v+ YUVA/bEJuCo2uMhDys3Vk9NSjv3+X/lg84PBj+2R6j+GcM0X//H6T4osfzawr9Pwiroov7yT EHCaX+zGf5JRfvyQfRcDgDJx1KtfCwKbOJ/aieAkheF53z5dUiIO4tieHGCvZWpvXg1z1c/+ bFRW9zfVuWeo/ysD/8vJpPgY+oaZFnYf3hGy4m4p1yl8kvgcCvpx8nGDwVY4tsXOkBzaGwzD xCgvUaDg49MG4eFGn3ieVtcdMxgTkJJaL4MHwsaeUT37FTa5zkwtdECwr50xFJq3Uwf70fws O9X7ghy+Ut8= Message-ID: Date: Fri, 27 Jul 2018 00:54:58 +0200 MIME-Version: 1.0 In-Reply-To: <20180726175432.GB17905@gnu.org> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] Cc: esd-translators@fsf.org Subject: Re: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jul 2018 22:55:12 -0000 Hi Iniev, thanks for your reply. Ineiev: > Hi, Tomas; > > On Wed, Jul 25, 2018 at 09:17:52PM +0200, Tomas Stary wrote: >> >> It has been brought to my attention, that many of my friends use >> webmail. The concept of an email client is slowly becoming obsolete. > > Some experts say email becomes obsolete... but I'm going to use it, > anyway. > Well, we still don't have a good replacement for email, so it can hardly become obsolete. But the webmail is pretty good replacement for email clients. Also, nothing stops you from using email client if you prefer to, because you are still able to decrypt emails from other people that use webmail with mailvelope. >> Trying to teach those people about email clients besides of teaching >> them encryption would only add to their confusion. > > Then they could try other communications (not email). > Which one do you suggest? EFF suggests signal, but it's impossible to install it without registering your phone number -- which is a mayor drawback. Going over that they do have a desktop app, but you still need to own a smartphone to register or go through complicated procedure with an command line application, which those people won't do. Telegram does not have free software server-side implementation I have been long looking for an alternative that does not require a phone and still work on my laptop. >> However, I have >> recently found the mailvelope browser extension (for firefox and >> chrome), which integrates the encryption in webmail. >> >> https://www.mailvelope.com/ > > I'm sceptical about any cryptography with webmail, > https://secushare.org/end2end > > I think it isn't just impossible---it's very impossible > to get it right. > Of course, if you do the email encryption client-side within the website, you still run the risk that someone will get the information through injected javascript. However, as I understand it, the mailvelope addon creates a separate container outside of the website, where sits the decrypted text, and that cannot be accessed from the webpage javascript. To the actual website the mailvelope sends only the cyphertext, so the attacker could only get the encrypted text through javascript. (but correct me if I am wrong) From MAILER-DAEMON Fri Jul 27 13:42:46 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fj6lK-00039b-Qg for mharc-esd-translators@fsf.org; Fri, 27 Jul 2018 13:42:46 -0400 Received: from mail.fsf.org ([208.118.235.13]:40807) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fj6lH-000398-9j for esd-translators@fsf.org; Fri, 27 Jul 2018 13:42:44 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([208.118.235.10]:57181) by mail.fsf.org with esmtps (TLS-1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fj6lE-0000JB-Qh for esd-translators@fsf.org; Fri, 27 Jul 2018 13:42:43 -0400 Received: from ineiev by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1fj6lE-0008GL-Eq; Fri, 27 Jul 2018 13:42:40 -0400 Date: Fri, 27 Jul 2018 13:42:40 -0400 From: Ineiev To: Tomas Stary Message-ID: <20180727174240.GI17905@gnu.org> References: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> <20180726175432.GB17905@gnu.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="9MuFfhk5HeaZrJik" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] Cc: esd-translators@fsf.org Subject: Re: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Jul 2018 17:42:44 -0000 --9MuFfhk5HeaZrJik Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Fri, Jul 27, 2018 at 12:54:58AM +0200, Tomas Stary wrote: > > Well, we still don't have a good replacement for email, so it can hardly > become obsolete. But the webmail is pretty good replacement for email > clients. > > Also, nothing stops you from using email client if you prefer to, > because you are still able to decrypt emails from other people that use > webmail with mailvelope. But if software on any end is vulnerable, all participants are affected. > >> Trying to teach those people about email clients besides of teaching > >> them encryption would only add to their confusion. > > > > Then they could try other communications (not email). > > Which one do you suggest? It's hard for me to suggest anything. I use email. > However, as I understand it, the mailvelope addon creates a separate > container outside of the website, where sits the decrypted text, and > that cannot be accessed from the webpage javascript. > > To the actual website the mailvelope sends only the cyphertext, so the > attacker could only get the encrypted text through javascript. (but > correct me if I am wrong) Let us start from encrypting. the user should enter the clear text in some area, then it's encrypted and sent. however, once someone knows that text, they can encrypt it themselves. now, what if the website popups a control that looks exactly like the one from mailvelope? the user will think the text is encrypted locally. When the text is decrypted or signed, I think the website could inject such controls between the user and mailvelope. Correct me if I'm wrong. --9MuFfhk5HeaZrJik Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEvZ1N7nsv8cvvLuDE4KzT4Mvnh0oFAltbWY8ACgkQ4KzT4Mvn h0qKhAgAmVTOf7/u0bqjcCwutr57Fly2G0wOWlw5DEGJPuwRChfkNw/LuPHGwD5Z 5IrM1hvkou87aTxHt8lj0gYDfeQXGwBM8z7WVzkuf2n+gGBdE4ydFA/jFqFx8Irz TJ9hIIgrwnIPWOebkgCVRFJsr2qbc/iuSaKU6VhihP9lbMbzyyA5+Pll4Pg3HZx2 tFmnpExtXmWQJYc2Ulvn2vGGoLNE5rj1OCrae0nAVFKuMKRNPLQBmchBRcPxzmow 3IyIWqGdpwx/WwpxTPFcgcOwNclEDvxcC7q3yrTfOTFqA3A9IcB2+rNEMu4j6O/8 GhEomUms7NxgBJHBKsWpRnntHpZ/VA== =PtAX -----END PGP SIGNATURE----- --9MuFfhk5HeaZrJik-- From MAILER-DAEMON Sat Jul 28 05:36:29 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fjLeH-0006ch-6L for mharc-esd-translators@fsf.org; Sat, 28 Jul 2018 05:36:29 -0400 Received: from mail.fsf.org ([208.118.235.13]:51437) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fjLeA-0006cL-8v for esd-translators@fsf.org; Sat, 28 Jul 2018 05:36:27 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_PASS, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from mail-wm0-f66.google.com ([74.125.82.66]:39754) by mail.fsf.org with esmtps (TLS-1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fjLe9-00021S-Sx for esd-translators@fsf.org; Sat, 28 Jul 2018 05:36:22 -0400 Received: by mail-wm0-f66.google.com with SMTP id h20-v6so8081244wmb.4 for ; Sat, 28 Jul 2018 02:36:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:cc:references:from:openpgp:autocrypt:subject:message-id:date :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=D2LIfL103BRGPV/GRI2se5jioPBrJ+zq7yxmRPEybT0=; b=tSXA+BwElHdt9hDCrU4cUjtjfuQOqqSUv238J46PUX/NLCwp59gJ+RJK9WqMBpYNwO /4fbJceuMapCEZMBOnswUuQ6jYgskASft7K5TQU1rGHPgRR991vbnLr8fvVuKiBoDzEB 9DcbQsaBpNWZazcSFs5o4xo5yMHpjjJQkSn75Jhk9oII/f2IS00Ll2ZzgFmwYf/RKy0A DKGWu9xlRiFylsB+nRew69Abq4zQVLT5Ypexl0zyBEe2bjqsgKc0b1tLoqo5NQVlqRBH zk2wIsTMqdvIearpRysChRXTmRzszz6EdV9PO6vkr21rTPyLP5TupSApg7nNKH9LTVuX O/Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:cc:references:from:openpgp:autocrypt:subject :message-id:date:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=D2LIfL103BRGPV/GRI2se5jioPBrJ+zq7yxmRPEybT0=; b=UzK86TMTVIMZK4shTtS2I/FaByKtEFnkujoSSddaTXUzy5daXYJ+2/JZZXMXhX0A1d eDWhclj7Ch37w1RCl+f4N9UDuqT48bWwHMHlEBd3GmAxL87abPUiFuvQ3hF/VxcR8x8E Heu6rOkxjAq/znIs4e4irLmtztDKAGF3zW8MTtvfNd0daEUSrcC+GHqi6kjEa180rwcV ZcvdgL+tomN+lbsFWIoITN7PiynhpM0eEpoWhd0mcWv3zZ6etq4t3OfpxCK6Kxv70Xab jlhIyacJNhjLUTThUhTORqnXq67fOnQSt11MUbkbVThGOCJ4ZQSFqHiff5raCFYemEPX Us8A== X-Gm-Message-State: AOUpUlHHmkxF64HNF9VAbAZfFF/xPLfhxKBClhJ/TR2Hiq+uSA1N9jDz iCZp6pZ8Qec8ovDssc7hHHIk+fv+ X-Google-Smtp-Source: AAOMgpdd5+wu2daAoxT4q3CCaxExMQBvlGLRpqa5J1b4zanzkQ8tXMctkjhccc/h0yMpRRiaLRqprw== X-Received: by 2002:a1c:4489:: with SMTP id r131-v6mr7268676wma.128.1532770579455; Sat, 28 Jul 2018 02:36:19 -0700 (PDT) Received: from [127.0.0.1] (exit04.brasshorncomms.uk. [185.104.120.3]) by smtp.gmail.com with ESMTPSA id r140-v6sm12155711wmd.7.2018.07.28.02.36.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 28 Jul 2018 02:36:18 -0700 (PDT) To: Ineiev References: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> <20180726175432.GB17905@gnu.org> <20180727174240.GI17905@gnu.org> From: Tomas Stary Openpgp: preference=signencrypt Autocrypt: addr=tomichec@gmail.com; prefer-encrypt=mutual; keydata= xsBNBFMCNhABCADy6MES/DD7lUFk14wC5xOd6r7aa1s6vZMjAtSueTluOWHYjMNT8cvrSXoz pqrlgfWDUre2p0vFbNxZAfePboltVcyUNjO7eKpPtjhhxYWHFYFY9qNjYipX1RwHA1xaKRPy bqcNgvuQxBdw0R6TZu7m1wS6cC0GIUyWQLyZGygg3gyIdzhYeUmUfLvcmvTMSRsxEWgjo5ZI c4+2lYdh/YQbYhqO86O6h5ZtYOYcZPRlvTJfikMJyB/dDUhVI46qHE/olMG8s6z1D8D9GQIB uCJ6GhQnGbst+Mg2XD2UjDVwFnKrIJqrDpmGKbiYM5dxdT9XwH35Q5aaIp1stndVompvABEB AAHNIFRvbWFzIFN0YXJ5IDx0b21pY2hlY0BnbWFpbC5jb20+wsB/BBMBAgApAhsDBwsJCAcD AgEGFQgCCQoLBBYCAwECHgECF4AFAlltBKwFCQotNZwACgkQNP6tNcbMStZCZggAww35scLy 2HfJlOwMm0cn1XPaglQXup3poE0BdSq/RBk9JHt+NMRbMG2x6bJ+m6OCIXmsSULsp4xfzeQb SMBeOT9YSD26wr1vl/90B1qK7jXvMyM3lOEvHzXEgO64cifzs0N2Fb6JMoOqZor4vsK02BeE Qyy1QuI3RG2IeVLOB75iEPVwiJ7o7tUNmiXdugup1A9TJ4LNJd+KK6xH9EZLhGvy9efwlJba z4/rZKlRwvr3hxRcP2xtjJC/VLwTgaihdtuH/vMfAKpFxxIChqfoVyHDkezNUtLpjOD0oBWa ArOrgAncsSlBUQHeUEb4B3oVgPpacSFkNIlPgSRJEf77Os7ATQRTAjYQAQgA5qB9byhX8yNC YZRjoTOnc7F/vF3nVAIM4uDbPYhpMl3U++/RUXl5ZsNZMAx1PiE5ifeVbEzpYKX91PgC6kdO 4WqxcZzOLgezOgjECppB6QNysOYduqeVYz16fU1Ym8mFwPGoubQm8rX9lNp8Qm78Hg1ekBQX xxhIT6k/AjP52S8Kyd2CHdul7BsvLsRUeuREqX/j3Fmj3NiFNqxD7LEfVilIBSs7VIP68X5S cF0YpWcI1XY/URDPutfFsLYaE3+Fl0dL3+Az83hMH+K6a8hh5H/aNQxxwdYm8Ke625snV5yx Qe6dtwuqdK8wxIjXMMn7Vi1lxg70BoBWMZWcNVuIkQARAQABwsBlBBgBAgAPAhsMBQJZbQUm BQkKLTYWAAoJEDT+rTXGzErWo9kIAJzF7GInXolu0FNA9DasvRRz0aDINw5i+Lvl08PsI9v+ YUVA/bEJuCo2uMhDys3Vk9NSjv3+X/lg84PBj+2R6j+GcM0X//H6T4osfzawr9Pwiroov7yT EHCaX+zGf5JRfvyQfRcDgDJx1KtfCwKbOJ/aieAkheF53z5dUiIO4tieHGCvZWpvXg1z1c/+ bFRW9zfVuWeo/ysD/8vJpPgY+oaZFnYf3hGy4m4p1yl8kvgcCvpx8nGDwVY4tsXOkBzaGwzD xCgvUaDg49MG4eFGn3ieVtcdMxgTkJJaL4MHwsaeUT37FTa5zkwtdECwr50xFJq3Uwf70fws O9X7ghy+Ut8= Message-ID: Date: Sat, 28 Jul 2018 11:36:12 +0200 MIME-Version: 1.0 In-Reply-To: <20180727174240.GI17905@gnu.org> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] Cc: esd-translators@fsf.org Subject: Re: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Jul 2018 09:36:27 -0000 Ineiev: > On Fri, Jul 27, 2018 at 12:54:58AM +0200, Tomas Stary wrote: >> >> Well, we still don't have a good replacement for email, so it can hardly >> become obsolete. But the webmail is pretty good replacement for email >> clients. >> >> Also, nothing stops you from using email client if you prefer to, >> because you are still able to decrypt emails from other people that use >> webmail with mailvelope. > > But if software on any end is vulnerable, all participants are affected. > Quite true, depends on the level of thread you are trying to protect yourself against. If it is profiling from automated text-analysers for advertisement purposes, you are probably safe. If it is targeted attack on your person by intelligence services you might not be. >>>> Trying to teach those people about email clients besides of teaching >>>> them encryption would only add to their confusion. >>> >>> Then they could try other communications (not email). >> >> Which one do you suggest? > > It's hard for me to suggest anything. I use email. > >> However, as I understand it, the mailvelope addon creates a separate >> container outside of the website, where sits the decrypted text, and >> that cannot be accessed from the webpage javascript. >> >> To the actual website the mailvelope sends only the cyphertext, so the >> attacker could only get the encrypted text through javascript. (but >> correct me if I am wrong) > > Let us start from encrypting. the user should enter the clear text > in some area, then it's encrypted and sent. however, once someone > knows that text, they can encrypt it themselves. now, what > if the website popups a control that looks exactly like the one from > mailvelope? the user will think the text is encrypted locally. > > When the text is decrypted or signed, I think the website could inject > such controls between the user and mailvelope. > > Correct me if I'm wrong. > Good point. In mailvelope they tried to address it by "security background" image. Quote: """ The security background helps prevent user interface manipulations by third-party websites and applications. To increase security, create and change your customized Mailvelope background here. """ So it is harder for the attacker to mimic your customized background. From MAILER-DAEMON Sat Jul 28 06:54:27 2018 Received: from list by lists.fsf.org with public_archive (Exim 4.71) id 1fjMrj-0000ao-5j for mharc-esd-translators@fsf.org; Sat, 28 Jul 2018 06:54:27 -0400 Received: from mail.fsf.org ([208.118.235.13]:54275) by lists.fsf.org with esmtp (Exim 4.71) (envelope-from ) id 1fjMrg-0000ah-Kg for esd-translators@fsf.org; Sat, 28 Jul 2018 06:54:25 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mail.fsf.org X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=ALL_TRUSTED,BAYES_05 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([208.118.235.10]:44189) by mail.fsf.org with esmtps (TLS-1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1fjMrg-0002ak-6X for esd-translators@fsf.org; Sat, 28 Jul 2018 06:54:24 -0400 Received: from ineiev by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1fjMrf-0006I8-2S; Sat, 28 Jul 2018 06:54:23 -0400 Date: Sat, 28 Jul 2018 06:54:22 -0400 From: Ineiev To: Tomas Stary Message-ID: <20180728105421.GQ17905@gnu.org> References: <4f9361ca-d740-18d3-900e-c84824710a03@gmail.com> <20180726175432.GB17905@gnu.org> <20180727174240.GI17905@gnu.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="WqttXA4Bds05TaHY" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-detected-operating-system: by mail.fsf.org: GNU/Linux 2.2.x-3.x [generic] Cc: esd-translators@fsf.org Subject: Re: [ESD-translators] mailvelope Re: pEp X-BeenThere: esd-translators@fsf.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Jul 2018 10:54:25 -0000 --WqttXA4Bds05TaHY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jul 28, 2018 at 11:36:12AM +0200, Tomas Stary wrote: >=20 > Quite true, depends on the level of thread you are trying to protect > yourself against. >=20 > If it is profiling from automated text-analysers for advertisement > purposes, you are probably safe. > > If it is targeted attack on your person by intelligence services you > might not be. Agreed, the threat model matters a lot. > Good point. In mailvelope they tried to address it by "security > background" image. Quote: >=20 > """ > The security background helps prevent user interface manipulations by > third-party websites and applications. To increase security, create and > change your customized Mailvelope background here. > """ Yes, and this is what made me sceptical. I think this is not the level of protection I'm used to expect from cryptography: my attacker "just" needs to know what my controls look like. --WqttXA4Bds05TaHY Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEvZ1N7nsv8cvvLuDE4KzT4Mvnh0oFAltcS1wACgkQ4KzT4Mvn h0pT9ggAk+bQslB6y8p/WG+zYrLnf009EVdfTCkzgP0y5hqeDDJ9oQlmEpRzwazG eijOMzsltJeoVXnSbbnhCF0ieHNgxU8D14iJt6fg0411ks7dci9J1dtsLi6Nq+mW 4ejzJnHN7q6sZGlhveiiwMXesAEsSWhmNUqAZXX8dMZLztS8ehbW591r5fq6rsm+ rCNxrKX0pldNoncwEcmMEUAgCxxp+p2zntwic9LNTAgUXZCPMC6VdK++0KRSjbpo nv+0E0nV4eYziPgWjJ9N8akufoGp/UJdGk4MzLHlFHJwwG6hZ55Z5dQ6le5JkIF2 Gs2GmNrxcrv/Rfy1p2qbY6z/vGEg+Q== =Tcna -----END PGP SIGNATURE----- --WqttXA4Bds05TaHY--