Google has unveiled a Chrome extension that makes it easy to use end-to-end encryption for sending email.
End-to-end, as the extension is called, is still an alpha version, with only the code released for security audit.
“End-to-end encryption means data leaving your browser will be encrypted until the message’s intended recipient decrypts it, and that similarly encrypted messages sent to you will remain that way until you decrypt them in your browser," said product manager Stephan Somogyi, in a Google blog post.
He noted that such protection already exists via tools such as PGP and GnuPGP, but said "they require a great deal of technical know-how and manual effort to use".
The extension uses OpenPGP and will work with any webmail provider in Chrome on desktop, not only Gmail. It protects the body of the message, not the email subject line or the list of recipients.
Google is releasing the code so that the security community can test and evaluate it - likely a way to put off suggestions of backdoors being installed by government authorities. Google said any flaws found in the code will earn a bug bounty via its Vulnerability Reward Program.
"One of the reasons we are doing this source code release is precisely so that the community as a whole can help us make sure that we haven’t overlooked anything in our implementation of End-To-End," Google said in its release notes.
As the source code is being made available, anyone could build the extension and use it, but Google asked people not to do that, saying the tool isn't ready yet.
"The End-To-End team takes its responsibility to provide solid crypto very seriously, and we don’t want at-risk groups that may not be technically sophisticated — journalists, human-rights workers, et al — to rely on End-To-End until we feel it’s ready," the company said.
"Prematurely making End-To-End available could have very serious real world ramifications."
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
