My sacrifice!

I’m facing this “problem” for a long time now. How to effectively use GPG encryption/signing with gmail/webmail?

Well, one solution is to use a POP/IMAP program to fetch the mail from the server and decrypt/sign-check it locally (if possible inside the mail program). This is quite common, but where is the point of having webmail if you need local program to use it?

So, what are the other options?
1. Have GPG-magic happen on the server-side
2. Have GPG-magic happen locally, through browser.

Obviously first option is no more safe as plain text emails. Trusting someone, let alone ISP, with your gpg secret key is like replying to penis enlargement spam - you get f*cked!
Besides that, encryption/decryption is not exactly the most CPU saving process and ISPs probably couldn’t bare the load.

So, it should be user/browser-side based, keys stored locally and gpg running on local CPU.
The problem with this is that there is no browser out there that includes such a functionality! Is it really that hard to use some JavaScript to handle the text and some system calls to handle the keys and encryption?

Oh, wait, this is not so hard at all! Actually, it has already been done! And it works with a Mozilla program! Thunderbird’s Enigmail is just that - some JS and XUL wrapped arround system calls to gpg! And it’s in a shape of an extension. And what else uses extensions? Mozilla Firefox! And what is Firefox? A browser! And can interact with WebMail! Eureka! :)

So, how come no one “ported” Enigmail extension to Firefox? Is it really so hard? Is it really so different? Is it really so impossible to use a focused text field as input source, display some dialogs with XUL (just as in TB), pass everything to external gpg binary and then its output back to that focused text field?

I’m no JS/XUL/Mozilla hacker and I don’t know nothing about extensions and how they work, but… is it really so hard?

This entry was posted on Wednesday, January 18th, 2006 at 04:26 and is filed under Programming, Web. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.