Ubuntu QA:
BlogBrainstormPackage status
Log in
Ubuntu QA
The Ubuntu community has contributed 22700 ideas, 138270 comments, 2629576 votes
Idea sandbox Idea sandbox
Popular ideas Popular ideas
Ideas in development Ideas in development
Implemented ideas Implemented ideas
Idea #14693: Make (g)email safer for the world!

Written by kramer65 the 22 Oct 08 at 09:21. Related project: Firefox. Status: New
Rationale
It seems that email is a very very unsafe mode of communication. Although I don't have any world domination plans as yet, I would like to keep my things private from intruding governments as well as companies.

I've been looking a bit around and it seems that there is a lot possible, but that it's just very fragmented; GPG and FireGPG together with some extra functionalities would help us get started.

What if you created one package out of Seahorse/GPA/KGPG and FireGPG which after installation had the following functionalities for for example gmail (more email programs should follow);
- The first time you start it up, a key-pair is being made for your email address. The public key is automatically uploaded to the PGP Global Directory which then verifies the email adres with a verification email.
- When you send an email it automatically looks in the Global Directory whether the person you send the email has a public key and if it finds one, it automatically encrypts and sends the message. Also it automatically signs the email using your private key.
- When you receive an encrypted message, it automatically unencrypts it and checks the signatures using the Global Directory.

Using a system like this would get many people to use it since it is not so complicated anymore and just one package. The more people post public keys, the more it gets accepted by other email programs while it doesn't interrupt the current flow of emails since you can still send normal emails as well.

If you think intruding governments are taking a bit too much away from our privacy these days, please vote UP!

Links:
http://www.getfiregpg.org/
http://www.gnome.org/projects/seahorse/
http://www.gnupg.org/gpa.html
http://utils.kde.org/projects/kgpg/
For Dutch readers a thread in which we discussed things: http://forum.fok.nl/topic/1203205

39
votes
up equal down
Solution #1: Auto-generated solution of idea #14693
Written by kramer65 the 22 Oct 08 at 09:21.
Ubuntu Brainstorm was updated in January 2009. Since the idea #14693 was submitted before this update, its rationale and solution are not separated. Please vote accordingly, and if you have the necessary rights, please separate the rationale from the solution. Thanks!

Propose your solution

Attachments
No attachments.


Duplicates


Comments
Eldmannen wrote on the 22 Oct 08 at 11:26
Unfortunately PKI is a bit complicated.
This is what this idea wants to change, to make it easier.

But encryption is always interesting!

Interesting idea.

Auzy wrote on the 22 Oct 08 at 11:39
Actually, email connections can support SSL too, which adds another layer of security. But irrespective, this idea would work great with Implementing a Secure Internet Mode.

+1

kramer65 wrote on the 22 Oct 08 at 11:42
Exactly my point indeed!

It is a fairly complicated idea which should be used to make it very very easy for people to use it.
Something like automatic internet connection when you install Ubuntu. It is something very complicated which I wouldn't be able to do for myself manually, but which is so easy since you don't even know it happens anymore. Encryption should be the same. It should automatically do it without me thinking about what and why and how. It should just do it so that I know my email is safe!

But I guess nobody really likes the idea since it sounds too complicated..

kramer65 wrote on the 22 Oct 08 at 12:21
Can anybody explain me why this idea would be voted down? Since I had the idea that it is like THE best idea evah!

Since it is obviously an optional thing which for the people that prefer it would enhance security and could make encryption a more widely used system..

cheesehead (Brainstorm admin) wrote on the 22 Oct 08 at 14:53
1) Free press, open courts, transparency laws and organizations, and explicit legal rights of citizens are superior ways to prevent government abuse of power. Political problems do not usually have simple technical solutions.
2) Safer modes of communication already exist. Post for example - seal it with spit and give it to the government for three days...but they can't read it without a court order in most countries.
3) Doesn't prevent spam. Or encrypted spam. Or forged headers. Or forged signatures. That's a bigger e-mail problem.

Warbo wrote on the 23 Oct 08 at 00:14
I agree with this idea. If Ubuntu's going to try and include the best of the desktop and the Web then surely security is one of the desktop's best features. Having Ubuntu more secure by default, and including active security measures like this as well as the passive ones like Linux having no wild viruses, would be a great marketing advantage. Anyone made paranoid by anti-virus companies' FUD can sleep easy at night with Ubuntu :)

kramer65 wrote on the 23 Oct 08 at 10:20
@ Cheesehead
1) Absolutely true. But that are normally not measures anybody can take themselves.
2) Also true. But post is not as quick and costs money. I also don't find this quite a good reason why NOT to make email safer.
Why shouldn't we make cars safer? Well, we can already walk which is although slower, a lot safer..
3) This idea is not a "will solve all problems" solution. It will just provide more security against unintended readers of your personal information. I think a lot of companies afraid for aggressive competition would happily welcome this, and people in oppressive countries could more privately communicate. For them a political solution is not something they can easily install on their computer..

cheesehead (Brainstorm admin) wrote on the 23 Oct 08 at 15:08
@kramer65

Well considered, man.

chipbennett wrote on the 23 Oct 08 at 17:21
Automating creation/use of a GPG key pair would be convenient and useful for far more than just email.

Automating the download of public keys for email senders/contacts is also a very good idea.

What would be wonderful would be for KDE-PIM (or Evolution, for the GNOME users) to have some sort of wizard that searches the public key servers for keys for all email addresses in Contacts, and to apply all found keys to those contacts.

I'd rather have it done at a time separate from when I'm trying to send an email. Polling the key server as part of Send would just slow down that process.

Also, I like being able to set my options for signing/encrypting by default (globally, and per-user), as KDE-PIM currently allows.

kramer65 wrote on the 27 Oct 08 at 09:31
@ chipbennett

You are right in the sense that it would slow down the send action if it has to search the public key directory every time. Especially if you send an email to 10 or more people.

You could have a daily set time at which the list is taken from the public directory so that you always have an up to date list. You can simply save the email addresses which you send to regularly. When you send an email to a person who you don't have in your list it could give to option to search in the public directory or simply "send without extra security".

Wouldn't that make it better?

chipbennett wrote on the 27 Oct 08 at 13:30
@kramer65:

However it is implemented, such that it doesn't happen at the same time an email is sent, would be fine, I think.

The better-integrated it is into the PIM, the more it would get used.

The whole trick to using GPG is exchanging public keys with one's contacts. Once keys have been exchanged, signing/encrypting email and files is trivial.

I like a combination of:

1) A run-once wizard that checks the keyserver against all email addresses in Contacts.
2) An option to check the keyserver whenever a new contact is added, and/or whenever an existing contact (email address) is updated/changed.
3) A per-contact, manual keyserver check (either in a context menu, or as part of the contact details GUI dialogue)


Post your comment