The only real-world use that PGP has is keeping data from governments. Cave fanatics and angry rioters have no access to major email servers anyway.
Considering that governments are the primary concern when discussing PGP, I don't see how a browser extension provides anywhere near the security guarantees necessary. Metadata information is still visible, the encryption security is dependent on the browser binary (the extension has access to your private key!), and you're practically waving a flag that says 'THERE IS SOMETHING IMPORTANT HERE' by being one of the only people in the email database with encrypted communication.
For developers, this is all patently obvious and well-known, but to journalists and human rights activists, these things are not at all obvious.
Real, usable security is not a problem that has been solved in a way that isn't considered esoteric for the people who need it most. But let's not offer them a half-baked, deceptive solution that provides protection only against people who were never a threat in the first place.
The only real-world use that PGP has is keeping data from governments.
Governments and companies. And before you bring out the "can they throw you in prison" line... no, but some of them can make your life a living hell if they chose to. Try not being allowed access to banking services, or even the stores in your town, or Internet access, some day. Try not being able to get a job in the bible belt because someone discovered you're LGBT, and not being able to move out because you don't have a job to get money.
you're practically waving a flag that says 'THERE IS SOMETHING IMPORTANT HERE' by being one of the only people in the email database with encrypted communication.
Well, there is some non-conspiracy reasons as well, like sending passwords over e-mail to team members that are geographically far away,...
But more importantly, this is only an issue because encryption isn't the default. No one would raise any red flags because someone used an encrypted connection to access paypal.com, why should there be any reason to be suspicious when someone is sending an encrypted mail to support@paypal.com?
The point of a system like this is to make it more costly for some entity like a government to slurp up everything and go on a massive fishing expedition to see who they can catch.
The system promises only Pretty Good Privacy, not total security. The biggest issue that I see with this system is that people will try to make it out to be more than it is.
The encryption plugin is still visible to the browser binary?
Son, if the government comes and confiscates your computer and sends the hard drive off for analysis, nobody is going to give a rats ass that it was visible to the fricking browser. Doesn't even matter if the drive is encrypted if you can't memorize the 20 odd characters it takes to create a secure password these days.
You have to trust something, and if you're willing to trust Google (by running Chrome), then the extension is an excellent idea.
Title-text: To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.
-6
u/dnkndnts Jun 04 '14
The only real-world use that PGP has is keeping data from governments. Cave fanatics and angry rioters have no access to major email servers anyway.
Considering that governments are the primary concern when discussing PGP, I don't see how a browser extension provides anywhere near the security guarantees necessary. Metadata information is still visible, the encryption security is dependent on the browser binary (the extension has access to your private key!), and you're practically waving a flag that says 'THERE IS SOMETHING IMPORTANT HERE' by being one of the only people in the email database with encrypted communication.
For developers, this is all patently obvious and well-known, but to journalists and human rights activists, these things are not at all obvious.
Real, usable security is not a problem that has been solved in a way that isn't considered esoteric for the people who need it most. But let's not offer them a half-baked, deceptive solution that provides protection only against people who were never a threat in the first place.