Encrypting Google Calendar With Firefox Extensions 52
mrcgran writes "IBM's Nathan Harrington has an interesting essay on using open-source tools to ensure privacy on Google Calendar: 'Today's Web applications provide many benefits for online storage, access, and collaboration. Although some applications offer encryption of user data, most do not. This article provides tools and code needed to add basic encryption support for user data in one of the most popular online calendar applications. Building on the incredible flexibility of Firefox extensions and the Gnu Privacy Guard, this article shows you how to store only encrypted event descriptions in Google's Calendar application, while displaying a plain text version to anyone with the appropriate decryption keys.'"
And the ads? (Score:5, Interesting)
I wonder what weird context ads will show up on a gmail page full of encrypted stuff.
Re: (Score:3, Funny)
None, if you not only use this story's extension, but also Adblock Plus [mozilla.org].
Re: (Score:1)
So your point is that you would NOT use this extension - which enhances your security - because THEN you would see ads for stuff you don't want? Uh-hu...
Re: (Score:2)
no i would not use gmail anyway. I'm just wondering what the parser to get the ads would come up with.
Re: (Score:1, Interesting)
Are any of these extensions (CalendarEncrypt, Adblock Plus) against the TOS? As much as I believe that you should be allowed to do whatever you want on your computer, when your data is in the cloud the provider can always pull the plug so you better not ignore the TOS.
Re: (Score:3, Insightful)
The cloud is a lie. One we're better off not perpetuating at that. Our data is on Google's servers, under their control and used for their benefit. I realise you're referring unambiguously to this yourself when you talk about breaching their T
Re: (Score:1)
And then the MPAA is going to go after Google.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Find exactly what you want today!
www.eBay.com
afafasdf (Score:5, Funny)
jub arrqf nyy gung penc? Whfg hfr guvf xvpx-nff rapelcgvba zrgubq gung abobql pbhyq rire svther bhg!
Re:afafasdf (Score:5, Funny)
Re: (Score:2, Funny)
Your confidence in that encryption method is intriguing, Mr. Urrz.
Re:afafasdf (Score:4, Funny)
No I'm afraid the turtle escapade did not go quite as planned. Requesting a vet and some extraction tools. I submit that next time we grease the turtle and not the tubes. TTYL
Re: (Score:3, Funny)
The chair is against the wall.
But ...
BUT ...
John has a SHORT moustache.
Re:afafasdf (Score:4, Informative)
The chair is against the wall.
But ...
BUT ...
John has a SHORT moustache.
thanks for presenting me to this wikipedia's article on number stations: http://en.wikipedia.org/wiki/Numbers_station [wikipedia.org]
... "In the 1984 film Red Dawn, a band of high school guerrilla fighters hears two code phrases (each repeated twice) broadcast over the radio as they hide out in the wilderness. The phrases are: The chair is against the wall and John has a long mustache (the latter of which was actually used as a code-signal by the French Resistance during World War II)."
Re: (Score:2)
Quite. I'd propose to meet you in a fortnight for some crumpets, if you would have it be.
Naturally, we'll need the olive oil as usual.
Re: (Score:2)
Re: (Score:2)
aka
You should patent that encryption method! It's so convenient! I didn't even need a key!
Re: (Score:2)
I didn't even need a key!
His algorithm uses a 5-bit key, but the key space only has 25 valid keys. Therefore, searching this key space is trivial, even for a paper-and-pencil method. In this case he chose the most commonly used key for this algorithm (ROTn), which you happened to also try first: 13 (or in base-2: 01101).
Long live Caesar! (Score:2)
W twuifsr wh cih obr fch 14'r awbs pippo
Actual ads from Google (Score:3, Informative)
jub arrqf nyy gung penc? Whfg hfr guvf xvpx-nff rapelcgvba zrgubq gung abobql pbhyq rire svther bhg!
Just out of curiousity, I posted that into a new email with gmail, saved it to my drafts folder, then went to look, and the "context" ads that appeared are:
Secrets of the Shaolin
Rare Chinese Scriptures Translated Released for 1st Time Ever
Try Tai Chi QiGong
Live A More Active & Fuller Life, DVD/Videos, Free & Fast Shipping!
Coconut Soup (Tom Kha)
Made with Fresh Coconut Milk Loaded with Lemongrass and Galangal
Chi Kung Resources
See How Chi Kung Can Empower You. Learn How Today!
BE a Yoga Teacher
Teacher T
Re: (Score:2)
IBM pays people for this stuff...? (Score:4, Insightful)
I get why this article is on Slashdot (it's kind of cool), but why would IBM pay employees to work on this type of thing? It's impractical for several reasons...
Security & practicality:
Google:
Re: (Score:3, Insightful)
Under Security & Practicality you missed a few points:
4. It leaks information. The encrypted version shows when you are busy and free
5. There's no point using a 4096-bit key. Most calendar entries are 60 characters so the key size is overkill given there is probably less than 360 bits of entropy
6. Calendar entries are highly regular, a dictionary attack would be tractable regardless of the key-size because of the limited input space
Isn't obfuscation enough for most people? (Score:1)
Frankly, I think most people don't need military grade encryption for their calendar, they just need to be able to obfuscate some of the entries in a repeatable fashion (so you can search for obfuscated events) which is not trivially unobfuscated by Google (or any others, e.g., governments, who would like to search everyone's calendar for particular keywords).
For most people, even the "Leet Key" extension is overkill.
I've been thinking about this, have even worked up a Javascript-based very weak, keyed, rep
Re: (Score:2)
Errr, what keywords do you think governments would like to scan calendars for? I don't think there is much of a market for online calendar services for drug dealers or terrorists:
11pm Pick up 2kg of uncut cocaine
Weds [all-day] Cut the coke
or
Fri 9am Blow myself the fuck up outside the library
??? I mean, I can see your point that this overkill. I'm just suprised that you offhandly show such paranoia :)
Re: (Score:1)
> what keywords do you think governments would like to scan calendars for?
Donno, say, the local DA has just managed to convict P. Ed Erast for child porn, and he says to himself, 'Hmm, maybe I should run a scan on everyone's online calendars for the phrase "P. Ed Erast"?' He can't do that legally in the US, but that doesn't mean he might not want to do it.
> I don't think there is much of a market for online calendar services for
> drug dealers or terrorists...
That's a funny strawman, thanks for the
Been There, Done That (Score:4, Informative)
A major drawback is that it's usually very implementation-specific. The plugin has to be updated whenever the web application is significantly updated, and can usually be circumvented by the application provider if they really want. Additionally, encryption eliminates searchability, though there are some mediocre mitigations such as searchable encryption, tags, or searching for hashes of words. Note: WAPP hasn't been maintained since ~5/07, so it likely won't work with current applications without some tweaks.
If you have any questions, my email address is (my first name) DOT (my last name) at gmail.com.
- Gabriel Landau
Re: (Score:1, Funny)
> my email address is (my first name) DOT (my last name) at gmail.com.
Hey, I just tried "anonymous.coward@gmail.com" and it bounced.
It's good to see PGP in use. (Score:1)
Re: (Score:1)
1.
> it's very rare that I run into someone else who uses [GPG]
2.
> It's refreshing to see it making a comeback!
1. Why do you think it is that way?
2. What IYHO has changed compared to 1 and what still needs to happen?
Re: (Score:1)
I think the proliferation of webmail and AOLers has put the proverbial fork into anything that can't be simplified in its entirety to a toolbar button. You can click a button to sign and encrypt messages, sure, but you can't quite click a button to generate a key, sign someone else's key, send and receive from keyservers, etc.
Oh yeah, and no one seems to care, despite companies trying to think of new ways to verify that they are the sender of an email. AOL has their "Official AOL Mail", and everyone els
Known plain-text attacks? (Score:4, Funny)
Monday 9am - doing nothing ...
Monday 10am - doing nothing
Monday 11am - doing nothing
Monday 12pm - lunch
Monday 1pm - doing nothing
Monday 2pm - doing nothing
Re: (Score:1)
Well, lucky you, that you only have to work five hours.
SIMPLER: Why Not use httpS (Score:1)
Apropos (Score:1)
Why does Google NOT allow you to use all their services securely, i.e., TLS/encrypted???
Last I looked only Gmail and Gcal are able to be encrypted: httpS.
Why, with their ginourmous resources cpu power should be trivial. WTF?
And at least in most Europe and the USA legal issues, snooping should be moot.
Re: (Score:2)
Agreed... I use https for all of my Google stuff. I can't believe people do it any other way. The 3 main apps I use with it are:
GMail
Calendar
Google Docs
I can't believe that people actually use GMail and Google Docs _without_ using https! That is a lot of personal junk flowing over unencrypted pipes.
I have to agree with my sibling poster... why doesn't Google encrypt all services that can carry sensitive information by default? Just doesn't make sense.
BTW: Even Google Gears (used for offline google docs