It shouldn't have been any surprise at all, but Edward Snowden's leaks of NSA information have raised awareness of the fact that our data in public clouds, like Gmail, is not entirely private. The government can get a warrant for it and the cloud company can (make that \"has to\") give them access to all your data. Or they can spy on the internal communications of the cloud provider and not bother with the warrant. <\/p>\n
So what can you do? For a very long time you've been able to use PGP (Pretty Good Privacy) and similar software to make encryption end-to-end, so that only you and the person with the right encryption key can see the contents. Everyone else only sees \"ciphertext\" which is only crackable with an inordinate amount of time and computing resources. <\/p>\n
Yesterday Google announceda new development effort to make the use of strong, end-to-end encryption in Gmail easier to use. It's called \"End-To-End\" and, for now, it's just an alpha-stage programming project. It's written as a Chrome extension that usesOpenPGP.js, an open source OpenPGP implementation written in JavaScript, to run the encryption\/decryption on the local computer inside the browser. <\/p>\n
PGP has always been the gold standard for privacy in email, but notorious for poor usability. The idea of End-To-End is that by implementing PGP inside Chrome, it can be made easier to use. <\/p>\n
One big usability barrier for PGP is that it relies on a trust model called the \"web of trust,\" illustrated here. Everyone has to trust people specifically and keep track of who they trust and what their keys are, although they can make trust transitive by signing someone else's key: If Alice signs Bob's key, they anyone who trusts Alice will trust Bob. <\/p>\n
If this sounds complicated, that's because it is. Can Google make it easy? If not, it may not matter. <\/p>\n
(Image courtesyGnuTLS) <\/p>\n
Previously on Six Clicks:<\/p>\n
Six Clicks: How do you keep track of all your passwords? <\/p>\n
Six clicks: How hackers use employees to break through security <\/p>\n
<\/p>\n