nicolas-t / gaes Goto Github PK

It would be really cool if this could encrypt hangout audio and video before passing it to google.

I'm not sure how viable this would be, and any number of things could break it.

Possible problems:

1. Can't intercept media
2. Google re-encodes video after getting to their servers
3. Thumbnails are probably resized before video gets to the client, breaking encryption

I found this paper: Compression Independent Reversible Encryption for Privacy in Video Surveillance, which looks promising for problems 2 and 3.

Generate a passphrase automatically when chat is initiated and share it with public keys. Public keys are only shared once (first time chatting with someone) and only need to be verified once (e.g. via phone), with subsequent chats using cache of public key from first contact.

Might want to use a library like OpenPGP.js http://openpgpjs.org/

Every time I chat with a friend that I have set up, I see garbage in the chat window. Anything I can do to fix it?

I changed the passphrase a couple of times. The first time I set it, only I could see my messages (my friend had the passphrase wrong), so I changed it and now no one can see anything in clear text??

Browser caching, etc...??

Not to XSS you,
https://github.com/nicolas-t/gAES/blob/master/gAES.user.js#L218-L230

Maybe you should add output encoding,
https://github.com/chrisisbeef/jquery-encoder

Also, to anyone listening, please consider using OTR.

This would be much easier to convince my friends to use if it was a Chrome App instead of a Greasemonkey script. Would such a thing be possible?

Google's official Hangouts Chrome App here - https://chrome.google.com/webstore/detail/hangouts/nckgahadagoaajjgafhacjanaoiihapd

It seems gibberish-aes is encryption only, with AES in CBC mode.

It would be better to add MACs to keep the encrypted texts unmodified in transmission.

I guess you can use the Stanford Javascript Crypto Library which provides the CCM mode.