Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires that both the sender and recipient have PGP installed on the computer that they are using. And it requires, of course, sharing keys. From my understanding, this means that one can't use a public computer or for example a work computer to do encryption with PGP. Since we can't assume that all computers have PGP installed, this, in my mind, seems to make PGP undesirable to use on a large scale

I understand that

  • There is pretty much no such thing as perfect secrecy in the real world
  • One might not want to use public computers or work computers to send sensitive information even though there might also be an advantage in using a public computer in a library.

Since most computers are connected to the internet, my question is:

What is a "good" way to encrypt messages using just the internet that does not assume any installed program except a standard browser like Firefox, Chrome, etc?

So I am looking for a way to use for example Yahoo Mail or Gmail with online based encryption.

I am not necessarily interested in "very strong" encryption. I am just interested in encrypting emails and not necessarily files.

share|improve this question
1  
What are you trying to protect, confidentiality? And from who? Passing notes on Fermat's Last Theorem might only need rot13. –  this.josh Jun 13 '13 at 6:18
    
@this.josh: Yes, I was just wondering about encrypting emails and such, but as mentioned, I don't need serious strong encryption. –  Thomas Jun 14 '13 at 20:37

1 Answer 1

I don't know any good methods that already exist. I see two ways to fulfill your requirements.

  1. Javascript Cryptography. There is widely differing opinions on the effectiveness of Javascript cryptography. I personally believe that most of the current implementations have huge flaws. For a good argument against Javascript cryptography, see this link.

  2. Trusting an online server somewhere to perform the encryption. This might work provided you trust the provider of the encryption service. I personally have no problems with trusting some of the more reputable companies out there to do this for me, but I can see some of the more suspicious or paranoid individuals having problems with this approach.

Both methods have flaws. Besides being slightly easier to use, I don't see much of a point. Any information you decrypt on a public computer will always be susceptible to keyloggers or other forms of malware. If it is information you need to keep secure, always access it from a trusted computer.

share|improve this answer
1  
You could also get a VPS or dedicated server and run the web server yourself to access it. –  AJ Henderson Jun 13 '13 at 4:16
    
@AJHenderson True... but at that point just use PGP dammit! :) –  Terry Chia Jun 13 '13 at 5:05
    
What are some of the companies that you mention under point 2? –  Thomas Jun 14 '13 at 20:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.