13 February 2009

PGP in Gmail?

Note: See the update below!

Do you have any idea what to make out of this? No, they're not fake.

And after clicking...

I only saw this in one conversation that I had open in a "New Window" (actually a tab). Every message had it at the bottom. I tried to reproduce it with other conversations, both new window and not. I even looked at messages that have a PGP signature and tried to see if it mattered whether a person was in my contacts or not. Alas, it was all to no avail.

Update 1: A few hours later and a lot more investigation have resulted in the discovery that Google is testing PGP verification in Gmail.

Here's what one finds when one greps the source (... Luke):

$ grep -i PGP a.html

function zOb(a){var b=a[dd](/(-----BEGIN PGP SIGNED MESSAGE-----(.|\r?\n)*?-----END PGP SIGNATURE-----)/);return b?b[0]:null}function AOb(a,b,c){if(!a.ff())return 1;var e=zOb(a.Ug());if(e==null)return 2;try{if(c==null||!c.Fp())return 4;var f=b();if(!f)return 3;return c.Omd(e,f)?5:6}catch(g){return 1}}function BOb(a,b){sp[j](this,a);this.XN=b}function COb(a){pZ[j](this,a)}var XNb='<applet code="',YNb='" width="0" height="0"><param name="archive" value="',ZNb='"/></applet>';OZ[k].Omd=function $8Qa(a,b){return this.YBa.verifySignature(a,b)};OZ[k].Fp=function $9Qa(){return this.YBa!=null&&this.YBa.verifySignature!=null};OZ[k].Lgc=function $$Qa(){var a=this.wbc();document[ye][H](a);return a[Fe]};var DOb="PGPApplet",EOb="exp/799/pgpapplet_0.jar";OZ[k].wbc=function $aRa(){var a=document[Qi](M);d(a,WNb({code:"com/google/caribou/pgp/PGPApplet.class",name:DOb,archive:EOb}));return a};Dq[k].sua=null;var FOb="pgpEngine";Dq[k].JBc=function $bRa(){if(this.sua==null)this.D.sua=new OZ;Sn(FOb,this.sua)};Dq[k].orc=function $cRa(){this.JBc();return this.D.sua};var bOb="snHRaf",jOb="kCeyR",kOb="Click to verify PGP signature in this message.",lOb="Verify signature",RZ="vPzQab",mOb="Info",nOb="No valid PGP signature found.",oOb="Warning!",pOb="Invalid key entered.",qOb="Applet not loaded. Is Java enabled?",rOb="wrClmc",sOb="Success!",tOb="Your message was verified successfully!",uOb="Verify again",vOb="The signature was incorrect! This message may not be authentic!",wOb="Internal error occurred.",xOb="nKAWHb",yOb="dlMhw";o(BOb,sp);var GOb={C1b:tqa};P=BOb[k];P.ub=function $dRa(){this.IOb(0)};P.Lx=function $eRa(a,b){if(!ee(b,xOb))return false;var c=this.ycc(),e=this;fca(c[w](),function(){e.rTc(this)});return true};P.ycc=function $fRa(){var a=new ed(Xj);a.V(fj,uU);a.V(JG,this.XN.Hc().Yc);return a};P.IOb=function $gRa(a){d(this.b(),aOb({id:this.Jj(GOb),w1:a}))};var HOb="Enter sender's PGP public key:";P.rTc=function $hRa(a){function b(){return hT(HOb)}var c=this.XN.w().orc();this.IOb(AOb(a,b,c))};_B_prog(97)}catch(e){_B_err(e)}

<form method="get" action="?tf=1&amp;ui=2&amp;ik=20658725fc&amp;view=cv&amp;th=11f6233736b8d787&amp;msgs=11f622c66e59b189&amp;rt=h&amp;search=sent" style="overflow: hidden; position: absolute; visibility: hidden; left: -10px; top: -10px; height: 10px; width: 10px;" accept-charset="utf-8"></form><div><applet code="a_data/PGPApplet.html" name="PGPApplet" height="0" width="0"><param name="archive" value="exp/799/pgpapplet_0.jar"></applet></div>

Unfortunately, a_data/PGPApplet.html doesn't give much information. It's appears pretty much the same as the loading page.

Update 2: I'm grateful to Ionut Alex Chitu for the discussion about this. He has posted an article about Gmail's PGP testing on his blog.

1 comment:

Anonymous said...

This would be epic. Good find.