Subject: Re: [perpass] Gmail is now HTTPS-only

From: "Joe St Sauver" <[email-masked]>
Date: Fri, 21 Mar 2014 16:12:10 -0700 (PDT)

Hi and TGIF! :-)

Nicholas commented in response to Robert Story:

#> Unless the client does the decryption locally... If gmail offered this
#> option, I'm sure browser plugin writers would meet the challenge quickly..
#
#That is no longer webmail.  It would have serious usability problems.
#And to further put the obvious, even that provides no protection for
#incoming messages.

Speaking of plugins, isn't that precisely what the (free for personal Gmail
accounts) Penango plugin currently does for S/MIME in Gmail via Firefox or 
IE? See https://www.penango.com/ (no relationship to that outfit, except as 
a user of their free product on my personal gmail account from time to time)

Gmail with Penango sure looks and feels like web email, just with S/MIME 
support bolted on...

As to protection for incoming messages, if both sides have an S/MIME
compatible email user agent, it would certainly seem as if they should 
be able to encrypt outgoing email, at least once they've exchanged keys
via an initial signed email, no?

Regards, and hope everyone has a nice weekend,

Joe

Disclaimer: all opinions strictly my own

---

From: Robert Story <[email-masked]>
Date: Tue, 25 Mar 2014 09:53:46 -0400

On Fri, 21 Mar 2014 16:12:10 -0700 (PDT) Joe wrote:
JSS> As to protection for incoming messages, if both sides have an S/MIME
JSS> compatible email user agent, it would certainly seem as if they should 
JSS> be able to encrypt outgoing email, at least once they've exchanged keys
JSS> via an initial signed email, no?

Even if both sides don't do S/MIME, if a webmail provider allowed users to
upload their public key and then used that key to encrypt anything that
wasn't already encrypted on arrival, then the data is always protected at
rest.

Robert

--
Senior Software Engineer @ Parsons