[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: end-to-end encryption? SSL? GnuPG?
> The problem is people are extensively using webmail. They can use
> "mobile" Tor (TorPark), but the problem is the content of the webmail is
> not encrypted. So they can get anonymity, but not end-to-end encryption
> (so anonymity is also downgraded).
I've heard a rumor about this amazing new end-to-end encryption solution for
web called SSL. Apparently, it requires the web-server to be configured to
support it and if it is then end-to-end encryption can be archived by going
to a URL which begins with https://
https:// requires paying a Tax to a evil corporation to avoid getting a
message complaining about "not trusted" cert, but that only means the root
cert is not buildt into the browser; you can easily make your own cert too;
but this requires the users to verify that the cert used matches the
fingerprint announced on the website.
> My idea is to build GPG into Firefox or at least integrate it more
> deeply. GPG keyring (user's private and public key) should be an object
> similar to certificate.
> My observation is, that more and more services are moving into the
> iternet - and mostly into web. So web browser is a central technology
> for browsing, reading email, writing teksts (Writely), publishing
> things, configuring software, watching movies... even runnig OS (see
> YuOS for example) And web browser is becoming independent from other
> systems. In a future local operating system could be only web browser
> with connection to the internet. That is why we need end-to-end
> encryption built into it.
> If you find this idea reasonable and interesting, please promote this
> feature request:
I agree that your idea of using GnuPG for everything is excellent. The IM
client PSI is only one of many IM programs who now support using GnuPG for
chatting. I agree that websites serving pages using GnuPG and Firefox - and
every other browser out there - supporting it. I agree the idea is excellent,
but .. I seriously doubt GnuPG will replace SSL - ever. But .. I agree it's a
Also, it should be mentioned that Tor exit's can (and some likely do) monitor
traffic - thus; sending passwords to non-SSL websites (webmail, forums) etc
is generally very very dumb. http://tork.sourceforge.net/wiki/index.php/FAQ
Last, you mentioned Torpark. It's an .EXE, what's this .exe for? What else
have these people come up with?
Are you aware of this: http://sowd5dpn54rk2srl.onion/Back_Orifice info?
Perhaps there is a simpler solution, download Tor, Polipo and Firefox Portable
and make a .bat file (instead of torpark.exe) which does the same?
start "Tor" /DTor /MIN tor.exe -f torrc.ini
start "Polipo" /DPolipo /MIN polipo-20060920.exe -c polipo.ini
Just my random ramblings.