Hey everyone, I was wondering if anyone knows of a browser extension that hooks into the gmail interface and can encrypt the contents of an email before sending it.<p>It's always a problem to make security available for the masses (and actually secure!). Here's how I'd do it if I had to set one up.<p>The Chrome extension would prevent gmail from reading the email fields, preventing the saving of drafts server-side. On sending the email it would encrypt the content with a key that is unique per receiving address. If the client has the extension installed it can decrypt the contents automatically on display.<p>The problem is getting the decryption key across to the recipient securely, but that only has to be done once. After that the browser extension can hold it indefinitely. It could be done with a trusted third party site, which only holds the key for a very short time, and only for the first email sent to a new recipient. Power users could of course use their own ways of getting keys across.
I know one that is easy to use, secure and working (because I <i>very</i> slighty helped with the development).<p><a href="http://www.mailvelope.com/" rel="nofollow">http://www.mailvelope.com/</a><p>It is more secure than you would think - see<p><a href="http://www.mailvelope.com/blog/security-audit-and-v0.6-release" rel="nofollow">http://www.mailvelope.com/blog/security-audit-and-v0.6-relea...</a><p>it prevents from saving the drafts well. What is not yet iplemented are signatures
WebPG or Cr-gpg perhaps can handle the GPG part probably.<p>I'm not so sure about the not saving Drafts, that would require rewriting some bits of Javascript which might break other stuff.<p>As for key exchange, that shouldn't be handle by an extension. If you want to encrypt your e-mail so the other party can read it, encrypt it with their public key, which by definition is public and can be uploaded to a keyserver.
You'd be better off using a non-gmail service with this sort of privacy requirement anticipated.
Gmail is a pretty uninspiring service to use fully encrypted.