Comments (4)
Yup, this has been left out intentionally due to some missing hooks in Roundcube which would allow this behavior on the client side. This is definitely intended to be implemented at a later stage. Thomas said the following here:
"* There's no encryption for attachments. I know, this is hard or almost
impossible to implement on the client but it's a serious lack of feature.
We might consider to implement hooks that'll let you read attachment
contents back to the client in order to encrypt them."
It might be possible to hijack the existing function that is used to upload to encrypt the contents before the attachment is posted, I haven't looked at it that much yet. Expect this feature to be available in the future though :-)
from rc_openpgpjs.
Hi,
I just wanted to second sysmonk's point that nowadays email encryption is pretty useless without attachment encryption.
I know this is not so easy to implement but it has been done. Check out http://kerry-linux.ie/wee-mail/ for a working example of roundcube integration with attachment encryption.
I really hope this is a priority issue since it is so important for security conscious users.
Thanks and keep up the good work.
from rc_openpgpjs.
Impatient security conscious users can always encrypt their attachments using local GPG/similar installations instead, or submit a patch if my prio is somehow out of order. However Roundcube needs to be patched first, as explained in my first comment for this issue.
The WEE mail thing that you linked appears to be a PHP PGP implementation which is an instant no. rc_openpgpjs performs client sided crypto for security reasons, which WEE mail violates by performing crypto actions on the server. If I have missed or misunderstood it please point me in the correct direction and I'll have a look.
Basically: server sided crypto is broken by design. rc_openpgpjs will for security reasons never allow the server to touch private keys. rc_openpgpjs will have support for encrypted attachment at a later stage, at the current early beta there are more important things to be done first.
One way could be to send the pubkeys of recipients along with the attachment and let the server encrypt the attachment before sending it to the recipient. I don't like that solution since it would disrupt the clean plugin backend. And also it could cause problems where recipients are added after the attachment has been encrypted and so forth. It's a risky road with many potential bugs. I'm sure we can work out a better clean solution in JavaScript with the Roundcube developers once that stage is reached and that way retain client side consistency.
Either way I'm willing to apply patches for a working solution as long as it's secure enough to be considered temporary, unless the received patch is actually written the way that fits the project agenda. In that case there's no questions asked and of course the feature would be put in. I won't write an insecure solution or allow insecure solutions merged though. We need to keep to the standard.
from rc_openpgpjs.
Duplicate of #20
from rc_openpgpjs.
Related Issues (20)
- No proper handling on message sending errors
- [PROB] Email address name with special characters
- Add option to notify on sending unencrypted HOT 2
- Public and private key storage HOT 3
- Decrypting Spam/Junk mail before moving to folder HOT 2
- Small improvement: confirm password-dialog with Return
- Support bulk import/export
- Key import does not check whether a key is already there.
- Missing Pubkeys: autoimport HOT 2
- Automatically encryption by private key for later viewing sent messages HOT 1
- Once again: Blank page & "PHP Fatal error: Class 'rcube' not found" HOT 7
- Submit plugin to http://plugins.roundcube.net
- Not decrypting? HOT 4
- Encrypt Subject? HOT 4
- Signing related issue HOT 2
- Is this project dead? HOT 8
- Signing fails because "-- " (signature seperator) is changed to "- --" HOT 3
- Attach sign HOT 1
- Project forked HOT 7
- 4096 bit RSA key will not import HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rc_openpgpjs.