Streak Secure Gmail
Security and privacy
email encryption
SHOW HN2013
How HN took it
6 positive, 12 neutral or asking, 1 mixed, 24 critical, out of 43 comments about the project. Thread score -0.49.
Privacy: 2 for, 12 againstIdea: 4 for, 5 againstExecution: 0 for, 3 againstDesign: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Usability is a strong point compared with PGP-based tools
From 2 comments
Actually we went down the gpg public/private key path first, and realized that was way worse in terms of usability. Even though with symmetric you have to enter the password, at…
alooPotato on HNMy thanks to you and your team for having developed this. The cost of crypto is, at present, far too high for mainstream use - or so it seems. Undoubtedly, the challenges…
smarterat on HN
Open source and an encryption-by-default approach are welcome
From 2 comments
We built this extension to see if it was possible to prevent webmail providers from handing over your email data to other parties. We encrypt the email message on the local…
alooPotato on HNNumber of recipients seems like a good idea for separating personal and business to me too. Personally, I only use PGP for emails with my partner, but we definitely send way in…
Osmium on HN
Objections
Browser JavaScript cannot provide real security against code injection or Google itself
From 2 comments
From the Stanford JS Crypto library's page: > (Unfortunately, this is not as great as in desktop applications because it is not feasible to completely protect against code…
IgorPartola on HNYup, totally secure. Unless Google's secretly forced to add something along the lines of $(document).on("change", "input.streak__password", function () { $.post(...); });…
drdaeman on HN
Symmetric passphrase security depends on password strength
From 3 comments
We built this extension to see if it was possible to prevent webmail providers from handing over your email data to other parties. We encrypt the email message on the local…
alooPotato on HNHow is key reuse is avoided? It's even harder for users to maintain (separate random) key for every message. All the classical OTP key issues are here. Aka different message,…
Sami_Lehtinen on HNAgreed - quality of a password is the key. We wanted to start with something that regular people would actually use. Its current;y not the most secure solution - but we were…
alooPotato on HN
Chrome-only and no attachment or search support
From 2 comments
NB: This is Chrome-only.
pcwalton on HNhow would you do attachments and search? Big stopper for me for using something like this.
igmor on HN
Requests
Support for attachments and search
From 1 comment
how would you do attachments and search? Big stopper for me for using something like this.
igmor on HN
Cross-platform support
From 1 comment
It's too bad that firepgp couldn't keep up with the gmail api changes and eventually was aborted. The few times I used it felt pretty good. This chrome-only alpha software…
drmr on HN
Public key option or key exchange approach
From 2 comments
My thanks to you and your team for having developed this. The cost of crypto is, at present, far too high for mainstream use - or so it seems. Undoubtedly, the challenges…
smarterat on HNBrowsers just need to actually get on the security bandwagon and build support for public key crypotagraphy into an api. Then you could generate keys, export them to back them up…
dbpatterson on HN
Questions
Does Gmail still upload drafts or data while typing
From 1 comment
Just curious, but how can we be sure that GMail doesn't continue to do voodoo like uploading a copy of draft without complete transparency? i.e. will this also disable any…
lmgftp on HN
Is the encryption export-legal and how strong is AES-256
From 1 comment
What is the legality of this? I'm concerned that in general cryptography web products are potentially illegal…
sldjfwsiojf on HN
Alternatives named
Mailvelope (OpenPGP in Gmail)
From 1 comment
Mailvelope http://www.mailvelope.com/ uses OpenPGP and is nicely integrated with gmail.
jmvidal on HN
FireGPG
From 1 comment
It's too bad that firepgp couldn't keep up with the gmail api changes and eventually was aborted. The few times I used it felt pretty good. This chrome-only alpha software…
drmr on HN
Parley
From 1 comment
We're trying an approach with http://parley.co that involves storing a symmetrically encrypted OpenPGP keyring on the server for our users. That, combined with a UI that…
napoleond on HN
Hushmail
From 1 comment
>> storing a symmetrically encrypted OpenPGP keyring on the server > now THAT is the way to do it! Um, no. No, it absolutely is not. See also: Hushmail.
jlgaddis on HN