mailvelope/mailvelope

Browser extension for OpenPGP encryption with Webmail

Mailvelope

Mailvelope is a browser extension for Google Chrome and Firefox that allows secure email communication based on the OpenPGP standard. It can be configured to work with arbitrary Webmail provider.

OpenPGP backends

Mailvelope uses the following OpenPGP implementation

• OpenPGP.js for the Chrome Extension and for the Firefox Addon

Installation

Mailvelope is available in the Chrome Web Store: https://chrome.google.com/webstore/detail/kajibbejlbohfaggdiogboambcijhkke

For Firefox you can get it from addons.mozilla.org: https://addons.mozilla.org/en/firefox/addon/mailvelope/

Or check the releases section for latest builds of Firefox and Chrome installation packages.

Client API

You can find the current API Documentation on GitHub pages. The version will correspond to the current master branch. A demo page with unit tests is available at: https://demo.mailvelope.com.

Build instructions

If you don’t have grunt installed, yet:

npm install -g grunt-cli

and then get and build the sources:

git clone https://github.com/mailvelope/mailvelope.git
cd mailvelope
npm ci && grunt prod

Chrome

grunt dist-cr

The Chrome extension will be in dist/mailvelope.chrome.zip.

Firefox

grunt dist-ff

The Firefox web extension will be in dist/mailvelope.firefox.zip.

Development

Update your local repository:

# inside mailvelope folder
git checkout dev
git pull origin dev && grunt
# continue with 'grunt dist-cr' or 'grunt dist-ff'

There are a few more tasks/tools available:

• watch source code for changes and recompile if needed

  grunt watch

• test the firefox plugin

  node_modules/web-ext/bin/web-ext run --source-dir=./build/firefox
  

  It is possible to reload the plugin on changes, run the grunt watch task on another console terminal

• reset repository

  grunt clean

Website

https://www.mailvelope.com

Licence

Use of this source code is governed by the GNU AFFERO GENERAL PUBLIC LICENSE that can be found in the LICENSE file.

About

Contact: Thomas Oberndörfer [email protected] Twitter: @mailvelope Contributors: see list on GitHub

mailvelope's Issues

Auto-detect recipients

It currently takes a lot of clicking around to use
Currently it looks like:

1. Open popup editor and type away
2. Click Lock.
3. Click list of recipients
4. Click on particular recipient.
5. Click add.
6. Click ok.
7. Click transfer back

I'd like it if there was a way for it to parse my 'To:' field, and by default add those people's keys, as well as have a "encrypt and transfer button" to shorten the loop down to:

1. Launch popup editor
2. Type my reply then click Lock.
3. Verify the right people are there, and click encrypt and transfer.
   Much less clicking around, I think it would be a nice ease of use improvement.

Possible downside:
If you accidentally reply to all, it's easier to add extra people, since you don't have to add each by name anymore. But there's still that verify step, and it'd be easy to spot a large list opposed to a single entry (I'd hope).
It also might be harder to have it work on all sites, the more integrated it is with each.

Key Expiration Date Issue

Bug in how Mailvelope handles GPG keys with an expiration date greater than or equal to January 1, 2100. When importing e.g. following key:

http://keyserver.linux.it/pks/lookup?op=get&search=0xB1670CA06F37C752

Mailvelope displays the expiration date incorrectly, marks it as
invalid, and will not allow to encrypt messages with it.

Missing armor header line breaks decryption

getArmoredText method in decrypt frame relies on ":" in armored text.
Not present if message wrapped in pre tags.

Reply and Forward buttons in decrypted message popup

I'm using the option "In a separate popup from Mailvelope." for "Where are decrypted messages displayed?" It would be very useful to have Reply and Forward buttons in this popup ...

Evernote integration

I am trying to use the Mailvelope with the Evernote. It's work properly when I'm encrypt the note and save it. But when I'm trying to read it (I have both private and public keys at the chrome extension) it raises a error "Error! Could not read this encrypted message"

short (hex) key id missing

Add field to primary key tab in the key grid.

Feature: Support Outlook Web Access (OWA)

It would be nice if Mailvelope could work with OWA, it may be implementable as Outlook.com is supported.

Connection to key server

• find keys on key server, direct import
• automatic retrieval in encrypt dialog (non-persistent)?

Chrome: Hide the button on non-watchlist sites

I don't need the mailvelope button on non-watched sites, so it can just hide itself
(maybe via an option...)

Multiple user IDs

On my key (F2F3A5FA), I'm using two different user IDs.

pub   4096R/F2F3A5FA 2012-03-03 [verfällt: 2022-03-01]
uid                  Danilo Bargen <[email protected]>
uid                  Danilo Bargen (HSR) <[email protected]>
sub   4096R/C1683A4D 2012-03-03 [verfällt: 2022-03-01]

Mailvelope just selects the second one and does not allow me to switch. Such a feature should really exist, especially because the first one is my main key and the second is just used for university.

Private key security

Hello,
I just stumbled on this browser plugin, and found it nice and great 👍.

Until I read how it works… and saw the private key is stored in the browser local storage 👎

The browser local storage is not secure enough for private key storing - there are many ways to get the content (just have a look on duckduckgo with "browser local storage security").

OK there's the private key password - but I'm pretty sure it won't block someone who is interested in GPG private keys.

There was, some times ago, an extension[1] dedicated for gmail, using the local GPG command, meaning there was no need to import the key in the browser. A much secure way that is.
Unfortunately, due to gmail constant interface changes, the devs stopped this addons - but I'm pretty sure it may be good to have a look at its internals in order to prevent any private key import.

Cheers,

C.

[1] http://getfiregpg.org/s/home

Decrypt previous message in mail editor

There should be a possibility to decrypt the previous mail while you reply. This could be a decrypt button in the external editor. The workflow would be:

• click on reply in the mail provider
• click on mail compose button
• external editor opens
• click on decrypt button in editor to decrypt first found encrypted message in the editor

Pressing enter key after decrypting message duplicates message

After decrypting a message, pressing the enter key causes the decrypted text to be duplicated.

Browser: Chrome.

Cropped options

See http://cl.ly/image/302q1h3Z3U45

Signing and verification of emails

Is possible to sign emails?

Problem with decoding long messages

I was trying to decode some of the longer messages I have in my mail and the Mailvelope doesn't seem to be working for them. There is one, which decrypts well under gpg, but not in mailvelope: https://www.dropbox.com/s/9pvc7abj3k2oa0w/failedPGPMessage.asc . The private key (passphrase 12345) is in the issue #43 . (I tried to send the message to myself by gmail, gmail interface truncates it, but it opens after clicking on the "show whole message".)

I tried the openpgpjs test http://openpgpjs.github.io/openpgpjs/test/encryption.html and it seems it has troubles with the decryption as well, so it may be bug in openpgpjs.

Key incompatibilities Mailvelope <-> APG

• generate a new key pair in Mailvelope and import into APG (android), the APG does not encryp or sign with this keys. Same for GnPg Mac.
• only public keys generated in APG works in Mailvelope. Private keys, when importing into Mailvelope, dont work

Allow updating of keys

Regardless of issue #10 I'd like to see the feature to update keys already imported before to keep them up to date (new uids etc.)…

Remove header (comment, version) from encrypted message

There should be an option to create messages without header lines.

Importing keys: grep for according blocks

Steps that will reproduce the problem?

1. Export secret key using GPGKeychainAccess (GKA)
2. Copy the output
3. Import key by paste the GKA output into the Mailvelope import textfield

What is the expected result?
Imported key

What happens instead?
No key found.

Possible workaround:
Remove the public block.

Any additional information:
You should grep/analyze the input for "BEGIN XXX KEY". Then you could also remove the option to import a public or private key.

Support for non-latin characters

If a mail contains non-latin characters, Mailvelope will generate an invalid encrypted message which fails to decrypt.
This is due to the following issue in OpenPGP.js:
openpgpjs/openpgpjs#51

Can not decrypt message compressed with Bzip2

I have imported my gmail private key to mailvelope. I can not decrypt email sent from a enigmail on thunderbird. Mailvelope prompts me for my pass phrase, but when I click "OK" nothing happens. The prompt remains. There is no indication that the pass phrase is incorrect. I can click cancel.

I know that the message is OK because I can decrypt it with gpg on the command line.
The GPG header for the message is:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.8 (Darwin)

Mail sent from gmail/mailvelope is not recognized as being encrypted by t-bird/enigmail, but again, I can decrypt it on the command line.

System Info:
MacOS 10.6.8
Thunderbird 16.0.2
GnuPG 1.4.8

Option: always encrypt for primary private key

Option to set a primary private key. Key is preselected in the encrypt window. Allowing to always read messages in Sent folder.

Mailvelope Handling of Hushmail Generated Private Key

Mailvelope seems to pick the "wrong" key when handling imported Hushmail private key.

I've determined that Hushmail private key is the "sub key" in the key pair (using key ID, comparing Mailvelope's behaviour with and without the private key imported). With the private key imported, Mailvelope's passphrase prompt defaults to the "primary key" which seems to be the public key. Therefore the correct passphrase fails.

Is there a way to select/force use of sub key?

Unnecessary use of minified javascript

I am not sure why does Mailvelope use minified javascript.

It is not an "issue" per se, but causes worse debugging, while not helping anything - the javascript is not faster when minified, and the un-minified files are in the zip too (at least when built using the added makefile), and even if they weren't, the size of the zip would be about the same with minified and un-minified version (I think).

Support for SmarterMail & Zarafa

Mail compose editor:

• editor does not recognize the injection of the encrypted message. After send the mail is stored unencrypted (last state before encryption) in the sent folder. Simple click in the text area seems to trigger an update and solves the problem. -> Mailvelope needs to trigger a user event on the editor after encryption.

Decryption scenario:

• client uses iframes without src attribute which are currently not scanned for messages (this could be added)
• as expected messages in inbox are not identified, but not so for sent folder (page structure the same). Did Chrome start to inject content script into dynamic iframes?

Drag&drop images in compose popup

Any chance the Mailvelope compose popup window could support drag&drop of images?

UTF8 input in key owner field

UTF8 input doesn't work, at several layers.

• at the name of the key owner
• for the cleartext itself

....so for a lot of users who input just in UTF8, this is useless.

Optimizations for multi-user environments

e.g. password protected key ring

Allow tags for keys

Assign tags to keys and allow filtering e.g. in the encrypt dialog

Imported secret key from GPG cannot be set as "Primary Private Key"

Hi,
I'm running mailvelope version 0.6.1_0 under Ubuntu 64bit (natty), Chrome plugin and is seems that when I import secret key from GnuPG v1.4.11, it doesn't appear in the "Primary Private Key" table under Options>General. I can, however, still decrypt email encrypted to it, so it is probably only a small problem.

(the passphrase is 12345)

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1.4.11 (GNU/Linux)

lQc+BFF2mxwBEADFr9Us4XYXE06vrOqo5klQ+slwPDgil2YYUScDK7fAjIG9bSxW
iWxeLpZ51SPseBY+YRGLz1i5LwDr0zBvPow3dFPieyd0F6Pp0tu89Ch0jbNnhQtq
eTYVMso9aIsLvwaqrfA6QKhccNl9C4rYwuz+nBEXqzLzXnJxyp1HftCIBdJjoPHA
7Uwr6ADlQufA30P3xttxEsk3lBZfG/PS09OtJgbO8b8SbCAt9Uq19t8SstGS5PAa
7iR2eoT2mkb7Be99FTkKD2NkyABYeCibPd1L0UFvqkLVUORomKNVvQIVHz3NGNGZ
yFidoMI7FZs23UzeFNhJ8H19Fd985st35qqwUnq2jmLRuplSMQulcpb2OI4YpKM5
hBgsGEbMYW3C6rkEFsDaVHwGyfAeSpaE62zqpwDewoadDJXMwX/8sBY1t79n5mfd
Qnh5WjNRjtTqyatI/sQz9LIjvtoyT9pcJQ+nVA9gGoDYmzTi5h3zf9U+IlvwBOfD
LJBMSktj/HPIdIGABvJjtQ/D7WvzaN2dgmY+NRvZxOvE6TMa+vqfv0IDAqDSpdm4
QSyoLen3e7nKc0wLOjWesOGL/cUBnud1oroO/tFob6akdDKVtlbw7wTbS8a6/AFV
p6Ga3C0eI2BRAlkX2yzw4rVbTh+1FgNzekKfE+tlIi18npaMnSp3cExzGwARAQAB
/gMDArFYA9uBLwP8YHhSusOq6Mdl1MbxT5yqHlCjo2OYzteLdu5OYRgokBFN+hKX
eNW3hnyvJk3yRJDJwRXxGgnsJYIBON6COpMkH2uaZ+TdsblCdzoPwQCQNpKyVTDq
ataf2uIgjn8zAaQC5lVHUs5WmFkcB7/Hk67WjpUiXg8VkCfO9N9HKP0KcxD/nn1G
iROoE/TjcbX58ScKi5HNz/mt9vDASLHh1AZOeDIu/UjtWV2qnkAhdi14mB3Ki6sU
hUqYL0TegNvMop0Hl2Gwf8WPKP0UqrRAn9i25uL6eYN9C+69/9wb0kSB/yUgqNTO
zZqVQwMNAwatPp6Hgiprwj+XjIKgGlJPbMCnqyhmY8r8aJA6fknhIcOmqzA+lUUn
0ktO+aWiV7EazKWD3gSXVChXIzvIJUD2rUAR6qvs/kGGDuSZNe7/wTtqJRLFkcJ+
soLL8TmDke36PrTK2vYHv50996Iy9RDNHPmSMnPEJ0IysGvD/rv1GnDTt0CgAAJJ
fPnp51PeT5NidrlVrVjTuPLQTWtcrWivLEOpxlW4GkITfcPiJLGLg6PApC5VWpD1
szbeyw9K+Q0Y/5eFQH6p6LVh7fNUTywRdHcCOOErYXbHXDuvNMMuy3vbRCN/y4Cv
uSP0AwpnlP6QqeIG94lMRbozvuiw93k1FY5/4aw9heeMo0zSS0267sN3K9qg+wgh
vlBYWivDchy4WnY/BgkqHB9XPpdo+eUx/OR0oB0f9D9jbOZh2B7p8Yjfhro6x3eF
bqiJZpbT6F5Ewyd4YYASWGB9qM9bAAsyJrqaI60fvHtbSLMWZjtcFFB1eA9akHh8
4sZrE5JE2WY5f6X8P9UZCsDXROTFdwYk77uBiwULhNlVb/Cq4bCjAoXq+6bRpgLT
y1Mmr8Q68jDjZieHS8szUD0YP5i+NGdzzAIvVj0d1IuEiMWnk14MTmNyy3AJxhDK
weOOMj3sdo1ZqYC2NKbw86l5vyAkIOWhQlMWefQGSDiqOrpfz2n1HGWehWdjuogS
BCUFPrIiijIXATSPLjqe1xEk687UGx3PHkeyg/NwfyZ0wf1KYS/07xodTTE0lyJr
/K5FY2rLkD5xZYiVt0pDprV4l1Hk0a5txzzEIvr4Y8UMClogHpxDxHwHRdzgUI+0
4L/4hIWtvN4O5Ujwoqyjujh7pM/ofrYK3EoAPeIrQcxxGYnUUpQcZ4XzqMdZYC5V
pVfq+7+wAgrCjS7hs56yCKuxB5FicwnMrdsdq1TVhUXbcodRlWDiLku6rG3XmHjm
lkz4RGVBsptyZCJgdljEEc40d7ED9XjgFWxUJjV7plt0sBm00ak2loRhaj2DyFWZ
QrXqo0f1a7JGgRu3xYdTidd7VRlBfmnyfvDkYBLdEalyBp6mASBdg4upKBAD0BoF
fdmG7bFennDRzIDgONuJyQuCoDZ9WwqhOzRw7RA2mDcd4J1ECwESEf18+BpP5BbJ
yLCZzqjej0BQEOTdxj0Hl1tHJu9LroDMer6Ph1MSa6GMm4e9qg9EfUYoATOC+HvF
MuhJXpWepIGo96EkMJqrrjSKNjk7TGvjs7QzpKhmDk0cVj8xDbi7IUG2KL0sRFCv
DZLuFV8Z0v0QLUuLJ85DP/yJIyKcB88Vn/o9Ba9aUsPuofT51fz26M9w//X9RXzR
H8vbYmQlFCCrNjvCixiVH9BxomCt9CAGduIRff4Ad0VD0mR6yGP7gHqmLGYhuMG3
elzSUBHOc5nSgtAhE3GGsQrVmPBWM+Hq1T9xeiqVLomRtEdKdXN0IFRyeWluZyAo
dGhpcyBpcyB0ZXN0aW5nIGtleSBmb3IgTWFpbHZlbG9wZSkgPGp1c3R0cnlpbmdA
Z21haWwuY29tPokCOAQTAQIAIgUCUXabHAIbAwYLCQgHAwIGFQgCCQoLBBYCAwEC
HgECF4AACgkQPLcC3tDRvTfHVA//a9HACaPvzdSq9Q95zYWRGEwJnIY7Zs/oCJ+J
7kFaGdE+q7IeQQ8Y8L+pfGO0OLZOTopA+nkIEpiKCxbSrT/q1l5eWBevBDQZ8EVF
RqZ3zGTdQ0+8XeDwkO0msVeBT1+ninCVzUuDs2DgCLNU19n9aXn3SnujMDBof5BB
G3uMSuf+QQqQvU9Tb13B9ZQlmYEZa5K8/VvAlY7ABRElBHY+pJZ7txL5opNV64+W
/y2RgVankyon7JUw6MIJ6eQ2YZ+3LdHQ4GEfnIJGlrXBjlx5HF1wl+dedTwkjQ2/
P73QgyJZuCPL5kar+OUT589w7RPZ2DABiEuPNatGW6wx2FGVXm3YGeXjDu1YQaLB
VqA8dwtxjRygJqeLCv9p9OrVU1udX2xrovIHxzdSYyUZeozHmITt+VkZB93wtVfm
7jJWePfzofn9xylk8zJJXImMUdBDu7r4p1W55sw9KRw/HbJWooEWZW+j0EnvvtML
Zq1DWzMSNRvOUhaqodS+OYkDofrX/fNVz++oBbOuWWK1VerwKq7Hx2g9YZvlYeMP
QYTITYBD+t0SIjgMS5BNezHpBDMq69RbGzuFVPTpIh1oUKB5/uVyzXnPZF/hazXF
TVK8nDUsBvQgiO4Oxk4L07eMD9ztiXeoAf9SOxYsp4NXT9JJz0zanTDeKX03Q3iM
mmFTi/ydBz4EUXabHAEQALZlQyPPNDIUcA4Zh5aB0h7wB6wLtq6hDXZU7F7fgjTN
6PF+RfSOHPDes3RkrE87A+uj7pq6eDbPEfHdB2edUhehUeyMffnC/I5VYh50VUBE
Fw98zikkTtYWPI66FdTNvAiJJSlAXV/Z0jir515qh4bevlNMc9mZT0W+julVXuaY
cqQwjWwCisGgGax7Xyw2sMbko9h3dL3FgLraQb0oaNjPaBZKDdzgGhnsiCqQW7dD
Y7De7SjPqpppNI5dlicm+hkVdLBtDZOYSFZgbl6yDPxVCnai7tYsv4wuCcvRJ0t8
uEOQwkACTpNhCEPE6Llm3/N5kVqQcIF/04h3QGxD7bBLbm9cLIscYjYrXoAK9yCm
J1sAaZn9k4bIYxfwjMcCSxSIW1WhN2SiT9zXJA2cQ6Xgx7ri2YJC1IuXSA/OBmFw
tz8R+xN3dNK9XC5XvePAr0vzZ1+V0LUWyxeTmUz8jZDuzoTCesEcqPvVkB24KwnM
/NQfjGAPkxC8gKB+R8SqqrOApuZfXNwoUV6mm8Mc39e8SMmnVR9c8zRfyzHym7Es
WrupjmN/d7Ak0anO+9xTcj7r+JXaWpwn3ko5XhU6i7/sYU7n2Qu3sotZ6u8HtbPu
srwFxsn0CY8f8GC7Ywjwfk0mOB+RpOeYZcVy8pZzdDd2I3jE8yrch3DiF6VUbe4n
ABEBAAH+AwMCsVgD24EvA/xgf5H0kMe0q2Bo6k+QAfgSpYhUZY36pPoKMlUkMk2j
bRfRNhCNWNzZ22eh9MbCsG0GA4hKkDR0RTuRvaE1Oao/isY3jHJgNgnTFrJZV+1+
HVxe1WRZ4xUgZbRBzahbnRzOZ0S62TTOSydvj6u1Gr1aWI92DaKEP/p1IU6fd0EK
2cqUD1HSoKNjGtUxeQQqi77ejOMB7ZBA9DzNEG9qk/vjZrU55VTMLyHnBy52lPE1
EHlWGvKpzKsZKugE7WjH/Zawi3YQDFK82OK8s3J5P8IDRUYgheZ9Jgjon/bybG2N
UGtR0g3wmt0+dljEfvzefUCL+kJGmJzJmTOkLMa8qYMgiGz3UhEbf7HUEPQjU1Wt
CuSfX2/qAQS7h+hstt7H9+lYvmAjwEF2GWsnc8DXilHa4cygTWs9Xbead+Gc9Z/S
nQVJefZIy3biOlJgbbgJQ+od7VAfDfepEAlLEvETY5VNI2iD8H+oa2HneN4KHEIu
YOjsSEN/Yw/EgkcqQaX0CD4cqgJaoyB4tdKNbruWMHby/E94khkMehaN7rjhaF3O
86l3gcgYH1enXJjmd1ZsReydTMCDVT5qT4s5WM7Rc2VKHYPQqRyZWL71V4jl29/V
PTwsdmcIgjuBDY+EX9yTNmeODLM9W3o0pBjr4IeHQJa/l67Hj6goLqQFTUJReUc4
FR24V9Fpq93o6nI8KB2h8Q+DTxv1tiTu1MdIDmiqNmUyDdS/G6DMLM06y1delotH
HMHedV5gXh3L4Pr1JR32OC2aTTiHtqnuDNAxCtQOAai9i94/N7ZUNwNmChBMBAyW
nwnqbgunP/8m9JGxGHmC59D5o6kD+ZwCqG/bp9+TZEW8pC9K9ISLqw5OHVHQWEWq
kJOpHV5MUnjTtGDRDZ3jv/J7sn3Irf2qUcEuBqdHCX1H8Vfiha0J562TzklqJMfc
1nRD0khHcADUhAlCORlxZk/RNN67cNmJbVkewevmy3k1jQWqTGh6+Jig4hqgmVUK
yGRzGlw7HKXlyCmb6sXsh5mrCIsEKKBmb/aqGfmPdV0/dzUyOru1jBygmXoAs83L
3WyKsM/aQZa1P1YaA/EKiJ/m0E8Q3K/dSufXjoUodXwVIRAoJbnleq67N31o4zpP
AHCCHkOEqkcWcqK6ueq6z3Zwy2r+Dy5zpBkTcyYmJo/1R5q9eN13BWLd1RIK/oCX
kJs+ReqhLf8julGgfABeDapE0SNjw2twkyU4oQI8D+njcY4bZ0Po2F+0TUSS9cpp
bZa8T69jLAJ/mDV5DyBMaD4XwK+7umcHKZYpqYq2tYwgcEwge9XoCEaQ73crjyxi
X30rcgiUrF9iaxMa2Mtlz/WwMyuvutWjbh0SySc4cBkg7hGTW1fTcC50IEK+f1V1
7AuI2r5nZKuRtEppaXTMt6/jhqPgJTEnrc5xrnwhNlVZWO2HqTeijnY2MOegEL67
PMYDGnO98FrBHSRjn/ehCZb2htRML0VqHCMHxh4YW+zSs53qOnHKX6BVWdTIKrP5
2HavAFmIPdCzCn1cg/3spOZMky5bAQW9waLtpWPm8JdYWkIIjspM6EY+zBU0y+zr
eI1zjKEgKRS9CJ8QVAiZxJ4lT9jBnA9V4JlguPLtf9ga8GF8fsEFDB0pzKdtjgzK
r7/t5Iq0m4SNtwcqMmk2T4wh8LsTmeRH0DXJK29UgrrNH4tQ6yvVqHLlETiIIa9Q
QHyJ3e7Ns2vJLqPrKMZuKU5ukgVJHuvyIvLX3MT8x/05sY614JCJAh8EGAECAAkF
AlF2mxwCGwwACgkQPLcC3tDRvTdHuw/+M1GTy84WFDvZmdqetjrQegVAPDqoY4nU
jnW1UppUdwHff9A9swE4SadChVYdLH3oqH8csF4TFbLw5wNA9rRE3ZZ8n/e0T64V
/CjQH5u2Qo5LH8jX4AwDAwkYQ/nAQUFDbuVo04ubyCO1St/MsiNCKmUh3TYhtcUm
cYOPJ6Afj2wyVi8VHLXUxx+Gb7Y/+6JfG8sa2Ew6wlpGfBL49k/F9eH74SWJWOGj
P+vhMGzWjR7NGDj+kRslpR9z2M+Yp3eSbNVMWsxE4kAQg3cTFrqQhWnYxW7fzj8k
Rbqz+MEwaEcDRouMICPZ0nuHov5+OYO/aF/B+3IdiZ9yOuRRH/vGkd/Yj7YT+f2y
E7CY2kPeZrehXxVEB7/CbTMGyoZlRlfOAUd2gfeoWdAJTnjDYqcAtqXm4hkxlOjd
iUKrn1B8WClXOADY5KFl8jKNGoakiZsG0P/4S/oYcD0ImfbQgJ88KcD3vcJJvb6V
BDQkNRgJP2fokVendxoIHekH6pZtVCcG71nFQ1s6mV2K+8GNnfy7vjVp/Oq7Z5UP
VqNS1HBCM4or6Vc/ihTOWH2RkIr5EYzBBAzMEfC+CP1ouVriE3bwTwRgVdu4CDaF
HPpKsum1/JsVxbffUMgc7Mz7GdD2gnF+2uiAQbCerpSGeWiPgnXm1EtQI69LNbW4
GZOD3An8Fqo=
=75rA
-----END PGP PRIVATE KEY BLOCK-----
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (GNU/Linux)

mQINBFF2mxwBEADFr9Us4XYXE06vrOqo5klQ+slwPDgil2YYUScDK7fAjIG9bSxW
iWxeLpZ51SPseBY+YRGLz1i5LwDr0zBvPow3dFPieyd0F6Pp0tu89Ch0jbNnhQtq
eTYVMso9aIsLvwaqrfA6QKhccNl9C4rYwuz+nBEXqzLzXnJxyp1HftCIBdJjoPHA
7Uwr6ADlQufA30P3xttxEsk3lBZfG/PS09OtJgbO8b8SbCAt9Uq19t8SstGS5PAa
7iR2eoT2mkb7Be99FTkKD2NkyABYeCibPd1L0UFvqkLVUORomKNVvQIVHz3NGNGZ
yFidoMI7FZs23UzeFNhJ8H19Fd985st35qqwUnq2jmLRuplSMQulcpb2OI4YpKM5
hBgsGEbMYW3C6rkEFsDaVHwGyfAeSpaE62zqpwDewoadDJXMwX/8sBY1t79n5mfd
Qnh5WjNRjtTqyatI/sQz9LIjvtoyT9pcJQ+nVA9gGoDYmzTi5h3zf9U+IlvwBOfD
LJBMSktj/HPIdIGABvJjtQ/D7WvzaN2dgmY+NRvZxOvE6TMa+vqfv0IDAqDSpdm4
QSyoLen3e7nKc0wLOjWesOGL/cUBnud1oroO/tFob6akdDKVtlbw7wTbS8a6/AFV
p6Ga3C0eI2BRAlkX2yzw4rVbTh+1FgNzekKfE+tlIi18npaMnSp3cExzGwARAQAB
tEdKdXN0IFRyeWluZyAodGhpcyBpcyB0ZXN0aW5nIGtleSBmb3IgTWFpbHZlbG9w
ZSkgPGp1c3R0cnlpbmdAZ21haWwuY29tPokCOAQTAQIAIgUCUXabHAIbAwYLCQgH
AwIGFQgCCQoLBBYCAwECHgECF4AACgkQPLcC3tDRvTfHVA//a9HACaPvzdSq9Q95
zYWRGEwJnIY7Zs/oCJ+J7kFaGdE+q7IeQQ8Y8L+pfGO0OLZOTopA+nkIEpiKCxbS
rT/q1l5eWBevBDQZ8EVFRqZ3zGTdQ0+8XeDwkO0msVeBT1+ninCVzUuDs2DgCLNU
19n9aXn3SnujMDBof5BBG3uMSuf+QQqQvU9Tb13B9ZQlmYEZa5K8/VvAlY7ABREl
BHY+pJZ7txL5opNV64+W/y2RgVankyon7JUw6MIJ6eQ2YZ+3LdHQ4GEfnIJGlrXB
jlx5HF1wl+dedTwkjQ2/P73QgyJZuCPL5kar+OUT589w7RPZ2DABiEuPNatGW6wx
2FGVXm3YGeXjDu1YQaLBVqA8dwtxjRygJqeLCv9p9OrVU1udX2xrovIHxzdSYyUZ
eozHmITt+VkZB93wtVfm7jJWePfzofn9xylk8zJJXImMUdBDu7r4p1W55sw9KRw/
HbJWooEWZW+j0EnvvtMLZq1DWzMSNRvOUhaqodS+OYkDofrX/fNVz++oBbOuWWK1
VerwKq7Hx2g9YZvlYeMPQYTITYBD+t0SIjgMS5BNezHpBDMq69RbGzuFVPTpIh1o
UKB5/uVyzXnPZF/hazXFTVK8nDUsBvQgiO4Oxk4L07eMD9ztiXeoAf9SOxYsp4NX
T9JJz0zanTDeKX03Q3iMmmFTi/y5Ag0EUXabHAEQALZlQyPPNDIUcA4Zh5aB0h7w
B6wLtq6hDXZU7F7fgjTN6PF+RfSOHPDes3RkrE87A+uj7pq6eDbPEfHdB2edUheh
UeyMffnC/I5VYh50VUBEFw98zikkTtYWPI66FdTNvAiJJSlAXV/Z0jir515qh4be
vlNMc9mZT0W+julVXuaYcqQwjWwCisGgGax7Xyw2sMbko9h3dL3FgLraQb0oaNjP
aBZKDdzgGhnsiCqQW7dDY7De7SjPqpppNI5dlicm+hkVdLBtDZOYSFZgbl6yDPxV
Cnai7tYsv4wuCcvRJ0t8uEOQwkACTpNhCEPE6Llm3/N5kVqQcIF/04h3QGxD7bBL
bm9cLIscYjYrXoAK9yCmJ1sAaZn9k4bIYxfwjMcCSxSIW1WhN2SiT9zXJA2cQ6Xg
x7ri2YJC1IuXSA/OBmFwtz8R+xN3dNK9XC5XvePAr0vzZ1+V0LUWyxeTmUz8jZDu
zoTCesEcqPvVkB24KwnM/NQfjGAPkxC8gKB+R8SqqrOApuZfXNwoUV6mm8Mc39e8
SMmnVR9c8zRfyzHym7EsWrupjmN/d7Ak0anO+9xTcj7r+JXaWpwn3ko5XhU6i7/s
YU7n2Qu3sotZ6u8HtbPusrwFxsn0CY8f8GC7Ywjwfk0mOB+RpOeYZcVy8pZzdDd2
I3jE8yrch3DiF6VUbe4nABEBAAGJAh8EGAECAAkFAlF2mxwCGwwACgkQPLcC3tDR
vTdHuw/+M1GTy84WFDvZmdqetjrQegVAPDqoY4nUjnW1UppUdwHff9A9swE4SadC
hVYdLH3oqH8csF4TFbLw5wNA9rRE3ZZ8n/e0T64V/CjQH5u2Qo5LH8jX4AwDAwkY
Q/nAQUFDbuVo04ubyCO1St/MsiNCKmUh3TYhtcUmcYOPJ6Afj2wyVi8VHLXUxx+G
b7Y/+6JfG8sa2Ew6wlpGfBL49k/F9eH74SWJWOGjP+vhMGzWjR7NGDj+kRslpR9z
2M+Yp3eSbNVMWsxE4kAQg3cTFrqQhWnYxW7fzj8kRbqz+MEwaEcDRouMICPZ0nuH
ov5+OYO/aF/B+3IdiZ9yOuRRH/vGkd/Yj7YT+f2yE7CY2kPeZrehXxVEB7/CbTMG
yoZlRlfOAUd2gfeoWdAJTnjDYqcAtqXm4hkxlOjdiUKrn1B8WClXOADY5KFl8jKN
GoakiZsG0P/4S/oYcD0ImfbQgJ88KcD3vcJJvb6VBDQkNRgJP2fokVendxoIHekH
6pZtVCcG71nFQ1s6mV2K+8GNnfy7vjVp/Oq7Z5UPVqNS1HBCM4or6Vc/ihTOWH2R
kIr5EYzBBAzMEfC+CP1ouVriE3bwTwRgVdu4CDaFHPpKsum1/JsVxbffUMgc7Mz7
GdD2gnF+2uiAQbCerpSGeWiPgnXm1EtQI69LNbW4GZOD3An8Fqo=
=Mik3
-----END PGP PUBLIC KEY BLOCK-----

MIME headers shown for multipart message, with escaped UTF8 characters

I'm opening an old e-mail that goes like this:

Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
boundary="71GDUHkQ4uogWNBm"
Content-Disposition: inline
User-Agent: Mutt/1.5.13 (2007-09-12)

--71GDUHkQ4uogWNBm
Content-Type: application/pgp-encrypted
Content-Disposition: attachment

Version: 1

--71GDUHkQ4uogWNBm
Content-Type: application/octet-stream
Content-Disposition: inline; filename="msg.asc"

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.6 (GNU/Linux)

0oaZu+M2W3OrVJ+T3IhGBBARAgAGBQI+KBvzAAoJEGQOZC4vLwze
....

Mailvelope recognizes the encrypted part, but when decrypted, some headers are displayed, and UTF-8 characters are not decoded:

Content-Type: text/plain; charset=utf-8 
Content-Disposition: inline 
Content-Transfer-Encoding: quoted-printable 

Hello! R=C3=A9fl=C3=A9chis!

Error importing Hushmail generated keys

As the subject reads, mailvelope returns an error with hushmail keys. I've imported hushmail keys into GnuPG installed on the desktop with no problem.

Might this be an issue with openpgp.js itself? I say this because another Chrome extension, mymail-crypt, also has the same problem. See screenshot below.

Firefox instructions incomplete

What do you do after following "Build instructions" in order to actually install the Firefox addon? I also see the makefile trying to call "cfx" which I do not have installed, do I need to install the Addon SDK? The readme should probably say so in that case.

All settings gone

All my settings including my keys are gone. Was Mailvelope updated recently and could this update have anything to do with this?

No dialogues appear on clicking the encrypt button

Using Chrome 27.0.1425.2 dev-m on windows 7 prof.
Imported the public key of someone
Compose mail to them
Click on the encrypt button
The email goes pink with a close button at top right .. and no dialogs appear.
Same thing happens when receiving a pgp encrypted email ... pink box, and no popups asking for password

Keep password in memory

Currently password has to be re-entered on every decrypt.

There should be an option to keep the password in memory for the browser session.
Possibly with timeout.

Mailvelope has crashed (Ubuntu 12.04 startup/resume)

On both my computer and my girlfriend's computer (she hasn't even configured Mailvelope yet) we'll ~daily get this error popping up on Ubuntu 12.04 even though Chrome doesn't appear to be open yet. In fact, it's usually when we first turn on our computers and log in, or sometimes when resuming from screensaver lock / hibernate / standby.

Not sure how to troubleshoot or provide more info, any ideas?

Screenshot: http://i.imgur.com/YCNTP5w.png

I'm planning to present Mailvelope as a GPG tool in a talk Sunday, so some kind of preliminary reply would be awesome. Sorry I've been so lax in reporting this issue, it's been going on for months.

Toolbar button -> Options doesn't work

This is a bit weird:

• When I right-click the Mailvelope toobar icon and select Options, the options are displayed.
  
• When I left-click the Mailvelope toobar icon and select Options, nothing happens.
  

Update: both are working again after a Chrome restart.

Add the possibility to write/encrypt outside of webmail

(this is a feature request, but judging by reddit discussion a very frequent one)

I want to be able to write "outside" of webmail, but "inside" the webmail tab

what I mean by this... I want to be able to write the message in a window in gmail somehow, but without google sniffing my mail with javascript and saving it as draft.

New Gmail compose box

Google is recently testing its new compose box for gmail. And when you try using mailvelope, you will notice that some part of the mailvelope encryption popup is hidden.

Cannot open options (or anything)

Hi, looks like a great plugin. Unfortunately, selecting any action from the menu (Add page, remove page, options, help) results in the message:

This webpage is not available
The webpage at chrome-extension://invalid/ might be temporarily down or it may have moved permanently to a new web address.
Error 2 (net::ERR_FAILED): Unknown error.

Restart did not help.

I am using Chromium on Ubuntu 12.04: Version 20.0.1132.47 Ubuntu 12.04 (144678)

Any ideas?

Generating long keys stuck the browser tab

Generating 4kb strong keys stuck the browser tab, even when the key is eventually generated. The tab stops reacting, the bar stops animating, and Chrome repeatedly asks to kill the tab. Even when the tab is generated (it took about 5 minutes, though).

I think it's because the javascript is just one threaded and the thread is busy generating the key and not receiving any events.

I am not sure what to do with that.

PGP/MIME

Is there a plan to support PGP/MIME (sign&encrypt), including with attachments?

Export -> Send public key by mail

Adds illegal whitespace to the armored key text

Detecting pgp/mime messages in roundcube

Hi,

I just have been experimenting with mailvelope, it is quite nice!

I noticed that it is unable to detect encrypted messages that were sent with pgp/mime (instead of inline-pgp) in roundcube. I think that is because roundcube displays the following when you open a message that was encrypted with pgp/mime:

This is an encrypted message and can not be displayed. Sorry!

You can use the gear icon to view the source of the message, which then triggers Mailvelope's lock icon, and then you can type your passphrase, but then it doesn't know what to do and just hangs without displaying the decrypted message.

Facilitate public key import

In the same way Mailvelope identifies encrypted messages on the mail provider page, it should also identify public keys (plain text) and allow to import them.

GMail Search: Unable to decrypt messages with highlighted text

Minimal steps to reproduce:

• Send encrypted e-mail to yourself
• In GMail, search for "PGP"
• Click on the e-mail you just send yourself
• Make sure the word PGP is hightlighted in yellow
• Put your mouse cursor on top of the encrypted text

Expected result: Mailvelope recognizes the e-mail and offers to decrypt it.

Actual result: Nothing happens. Mailvelope does nothing.

Use all valid user IDs for recipient proposal

In the encrypt dialog only the first user ID of a key is displayed.
This means if a key has more than one non-revoked user ID and one of these
email addresses is used in the TO field of the mail provider then the preselection
logic in the encrypt dialog can't work.

Possible solutions:

• consider all valid user IDs for recipient proposal, still display only the first, but preselect this one instead
• display user IDs on encryption dialog in tree structure

No key export in Win8

Windows 8, Chrome 23.0.1271

• user cannot select entry in key table
• filter "Show keys by type" does not work