Freenigma: Encryption for webmail

rdsu · Sep 2, 2006

Freenigma: Encryption for webmail (Only for Firefox)
http://www.freenigma.com

Freenigma provides encryption that works across multiple webmail platforms. It isn't the first system to encrypt webmail, but it is the first that I'm aware of that encrypts mail for third-party services such as Gmail. You can send encrypted mail through Gmail if you use its SMTP and POP features, but you can't encrypt and decrypt mail within the webmail client itself.
Click to expand...

Full Story: http://www.malwarehelp.org/news/article-4744.html

Devinco · Sep 2, 2006

That's a cool idea. Thanks VaMPiRiC_CRoW.

From what I understand, the recipient will also need to have a Freenigma account and the extension.

Devinco · Sep 2, 2006

Well I thought it was cool until I read the comments at the bottom of this page.

I think this entry in The Shmoo Group Blog is great, I'm cutting and pasting here even though I am not related to the people in/of The Shmoo Group because too many people are too lazy to follow a link to read the blog entry if I just link it. All credit to the below quote goes to the person who originally wrote it at the link below:

http://www.links.org/?p=130 [links.org]

"I’ve been wanting a Firefox plugin for PGP for ages now. So I was quite excited to hear about freenigma. For about one minute, that is, until I read this
Does freenigma send my mails to the freenigma server for encryption?

No. All mail is encrypted or decrypted directly in the webmail client (i.e. directly in the browser). But how does that work?! For the experts: when making an encryption request, the freenigma extension sends nothing more than the list of recipient addresses to the freenigma server. In response, it receives a random session key for symmetric encryption within the client as well as an asymmetrically encrypted session key for all the recipients. AES encryption is then performed within the client using the unencrypted session key. Then, the user script in the client combines the symmetrically encrypted mail text and the asymmetrically encrypted session key to create the OpenPGP binary format.

Oh dear. So freenigma can decrypt my mails (and anyone else they care to give the session key to). What’s more, it looks like they have your private key, too, so they can impersonate you.
They don’t say how you decrypt, but I presume the story will be described with the same disingenuousness: no, you don’t send your encrypted mail to the server, just send us the encrypted session key and we’ll decrypt that for you. How comforting. Not.

They’re also a bit strange generally…

Why doesn’t freenigma encrypt attachments yet? Because we would have to first send the file to our server in order to encrypt it. And from a security perspective, that isn’t a clean solution.
Eh? So why can they encrypt the message locally but not the attached file?

And…

In addition, the separation of content and encryption is important because this is the only way to ensure that the data cannot be decrypted by an unauthorised third party.

Hang on - but that’s exactly what you haven’t done. The data can be decrypted by unauthorised third parties. These guys either don’t get it or they’re deliberately dissembling. Neither indicates someone you should trust with your crypto.

In short, this is not an extension I’ll be installing.

So now we need a Firefox extension that does this properly, more than ever. If someone wants to do it, I’d be more than happy to help. I even have a C library to do the PGP stuff (OpenPGP:SDK). Any volunteers?

August 28, 2006 11:37 AM UTC"

And FWIW, who is The Shmoo Group? "The Shmoo Group is a non-profit think-tank comprised of security professionals from around the world who donate their free time and energy to information security research and development."
Click to expand...

rdsu · Sep 2, 2006

You are right!!!

I forgot that the users, and only the users, should have their own private key to avoid that freenigma out any others can read the message!

Cerxes · Oct 3, 2006

If you´re using for example Thunderbird, then there is a plugin called enigmail that combined with GnuPG gives you a top encryption/decryption tool.

http://enigmail.mozdev.org/

Regards, C.

Log in or Sign up

Freenigma: Encryption for webmail

rdsu Registered Member

Devinco Registered Member

Devinco Registered Member

rdsu Registered Member

Cerxes Registered Member

Log in or Sign up

Freenigma: Encryption for webmail

rdsu Registered Member

Devinco Registered Member

Devinco Registered Member

rdsu Registered Member

Cerxes Registered Member

Useful Searches