HOWTO : Email encryption in a browser

Question

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing.

In my quest for learning how to use gmail/hotmail to send and receive encrypted emails, a couple of older tutorials point to firegpg a firefox addon but the projects homepage says that it is no longer under active development.

I also read that encrypting within the browser is also dangerous as javascript running on the page can transmit the unencrypted data, so it is better to have a separate program that does this job.

Is there a fairly recent howto or guide available on the internet which has all the details so that even a beginner like me can follow along. If so it would be nice if someone can point me to them otherwise if someone could explain how their email encryption workflow works.

I have no problem composing my email in a text editor and then encrypting them and sending that text in the mail body but I don't fully understand how I'd manage all the public keys of my contacts. Is there some program that does this?

I'm not looking for email clients like thunderbird, I want to use a web browser for email it works out much better in my experience.

Answer 1

Email is usually/historically encrypted using PGP or GPG. There are PGP and GPG addons for most common browsers;

You will need to generate a key-pair for yourself and follow basic key-management procedures. This is all fairly long-winded to put into an answer on here, but there are some GUIs available that make the process easier, such as GPG4Win.

The major caveat with all this is that you will need to convince your friends to participate. They have to decide to send you encrypted email, and likewise they have to set up a key pair themselves in order for you to be able to send them encrypted email.

This lack of a ubiquitous web of trust subsystem is why email encryption is still very much underadopted. The widely used PKI doesn't lend itself so well to email, as it lacks flexibility and is prohibitively expensive.

Email at its core is just raw text transfer. That doesn't change when you start encrypting things. Typically the body of the message is encrypted using the public key of the recipient. This encrypted message is formatted into printable characters (usually with base64 encoding), this stage ensures that the encrypted block, which might contain weird and wonderful bit-sequences that map to weird, unprintable characters, is transferred safely by encoding it in simple characters (base64 uses the alphabet, numbers and a few common symbols).

The browser addons are able to identify this encrypted block inside the web page, and will allow you to decrypt it, which returns it into a plain text format.

Answer 2

Another alternative is to use Portal Based Encryption, where the public keys are maintained in a central repository and a webserver hosts the public keys.

Examples:

1) Zixmail

2) Proofpoint Secure Email

Each of these products act as an SMTP relay of sorts and allow you to send mail to it from any system.

For the Proofpoint system they will receive a hyperlink in the email to log in. Once they log in a key pair is generated just for that user and they can reply securely (however as the system administrator defined "secure")

The Zix system will act similar to the Proofpoint system, however if the peer system also uses Zix, then the messages are transparently secured (like TLS between MTAs).

Answer 3

Addressing your concern about JavaScript stealing the information prior to encryption, I would expect that most browser plugins could get around this by having you enter the text to be encrypted outside of the page DOM itself and thus preventing malicious JavaScript from having easy access.

Answer 4

Hushmail is OpenSource and has already solved this problem.

Answer 5

There are tools that are using OpenPGP.js for encrypting data on your browser. For example, Mailvelope is one of them.