1 of 7Image
So you want maximum security for your email...
It shouldn't have been any surprise at all, but Edward Snowden's leaks of NSA information have raised awareness of the fact that our data in public clouds, like Gmail, is not entirely private. The government can get a warrant for it and the cloud company can (make that "has to") give them access to all your data. Or they can spy on the internal communications of the cloud provider and not bother with the warrant.
So what can you do? For a very long time you've been able to use PGP (Pretty Good Privacy) and similar software to make encryption end-to-end, so that only you and the person with the right encryption key can see the contents. Everyone else only sees "ciphertext" which is only crackable with an inordinate amount of time and computing resources.
PGP has always been the gold standard for privacy in email, but notorious for poor usability. The idea of End-To-End is that by implementing PGP inside Chrome, it can be made easier to use.
One big usability barrier for PGP is that it relies on a trust model called the "web of trust," illustrated here. Everyone has to trust people specifically and keep track of who they trust and what their keys are, although they can make trust transitive by signing someone else's key: If Alice signs Bob's key, they anyone who trusts Alice will trust Bob.
If this sounds complicated, that's because it is. Can Google make it easy? If not, it may not matter.
(Image courtesy GnuTLS)
Previously on Six Clicks:
Mailvelope: What Google aspires to build?
Amazingly (or not), someone has already built the system that Google is planning to build, and it's not just for Chrome and Gmail.
Mailvelope is a webmail implementation of OpenPGP which uses the same OpenPGP.js library as End-To-End. It is written by Thomas Oberndorfer and is open source. Oberndorfer tells me that the idea goes back to FireGPG, a Firefox extension project, since discontinued, to implement GPG (GnuPG, for GNU Privacy Guard, another OpenPGP implementation) in the browser.
Mailvelope integrates into these webmail user interfaces, but it has to be careful how it does so. It can't let the servers gain access to unencrypted data, so it launches its own UI in which the user composes and/or edits email, picks the recipients and encrypts (or merely signs) the message.