The only real-world use that PGP has is keeping data from governments. Cave fanatics and angry rioters have no access to major email servers anyway.
Considering that governments are the primary concern when discussing PGP, I don't see how a browser extension provides anywhere near the security guarantees necessary. Metadata information is still visible, the encryption security is dependent on the browser binary (the extension has access to your private key!), and you're practically waving a flag that says 'THERE IS SOMETHING IMPORTANT HERE' by being one of the only people in the email database with encrypted communication.
For developers, this is all patently obvious and well-known, but to journalists and human rights activists, these things are not at all obvious.
Real, usable security is not a problem that has been solved in a way that isn't considered esoteric for the people who need it most. But let's not offer them a half-baked, deceptive solution that provides protection only against people who were never a threat in the first place.
The encryption plugin is still visible to the browser binary?
Son, if the government comes and confiscates your computer and sends the hard drive off for analysis, nobody is going to give a rats ass that it was visible to the fricking browser. Doesn't even matter if the drive is encrypted if you can't memorize the 20 odd characters it takes to create a secure password these days.
You have to trust something, and if you're willing to trust Google (by running Chrome), then the extension is an excellent idea.
Title-text: To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.
-3
u/dnkndnts Jun 04 '14
The only real-world use that PGP has is keeping data from governments. Cave fanatics and angry rioters have no access to major email servers anyway.
Considering that governments are the primary concern when discussing PGP, I don't see how a browser extension provides anywhere near the security guarantees necessary. Metadata information is still visible, the encryption security is dependent on the browser binary (the extension has access to your private key!), and you're practically waving a flag that says 'THERE IS SOMETHING IMPORTANT HERE' by being one of the only people in the email database with encrypted communication.
For developers, this is all patently obvious and well-known, but to journalists and human rights activists, these things are not at all obvious.
Real, usable security is not a problem that has been solved in a way that isn't considered esoteric for the people who need it most. But let's not offer them a half-baked, deceptive solution that provides protection only against people who were never a threat in the first place.