Based on OpenPGP and a newly developed, JavaScript-based crypto library, End-to-End can be used to encrypt, decrypt, digitally sign, and verify signed messages. Google is keen to receive feedback -- discover a problem and you could cash in, thanks to the Vulnerability Reward Program. In a post on the Google Online Security Blog, Stephan Somogyi, Product Manager, Security and Privacy explains that "we recognize that this sort of encryption will probably only be used for very sensitive messages or by those who need added protection. But we hope that the End-To-End extension will make it quicker and easier for people to get that extra layer of security should they need it".
Releasing the source code for a project such as this is a risk, but it is one that Google recognizes. The project home page acknowledges that there is nothing to stop people from compiling the code and submitting it to the Chrome Web Store, but implores "please don’t do this". Eventually, End-To-End will receive an official release, but in the meantime the team is asking that the code is used responsibly:
The End-To-End team takes its responsibility to provide solid crypto very seriously, and we don't want at-risk groups that may not be technically sophisticated — journalists, human-rights workers, et al -- to rely on End-To-End until we feel it's ready. Prematurely making End-To-End available could have very serious real world ramifications.Security has become a real headline grabber over the last couple of years, and on June 5 Reset the Net aims to encourage and educate web users about online security and privacy. Tools such as End-To-End are welcomed with open arms.
Image Credit: Graham Stewart / Shutterstock
~ Mark Wilson
0 comments:
Post a Comment