{"action":"created","comment":{"url":"https://api.github.com/repos/leapcode/leap_se/pulls/comments/47242655","id":47242655,"diff_hunk":"@@ -0,0 +1,40 @@\n+@title = '2nd OpenPGP email summit'\n+@author = 'meskio'\n+@posted_at = '2015-12-10'\n+@more = true\n+@preview_image = '/img/pages/gnupg.png'\n+@preview = \"We've participated in the 2nd OpenPGP email summit were we had the oportunity to exchange ideas with many other projects.\"\n+\n+The [2nd OpenPGP email summit](https://wiki.gnupg.org/OpenPGPEmailSummit201512) took place in Zurich the 5th and 6th of December. LEAP was there among many other projects working on protecting email communications. It's been an intense weekend where we had the oportunity to hear from other projects how they are doing things and to discuss on how to solve common problems.\n+\n+There were many working sessions on a variety of topics (from email validation on key servers to password recovery). I'm going to highlight some topics that I think were very interesting.\n+\n+# Encrypted Indexes\n+\n+We've talked on how to index inboxes in a privacy preserving way. Considering how most users access their email nowadays, on a web browser loading what they need on demand, we talked on how that could be done in a secure manner.\n+\n+Assuming that you have the index in perfectly secure way, or locally stored or an ideal nifty way in the provider where you can do queries and the provider can not guess the content of the queries. Let's first assume that you have your emails stored as they arrive, your encrypted email is stored encrypted and your decrypted email is stored decrypted. After each query you retrieve the resulted emails, so the server sees which decrypted emails are related to which encrypted ones and in the long term can infer the content of the encrypted ones as well.\n+\n+Let's imagine then that you store all the emails encrypted. Then your provider could send to you crafted emails with the kind of content she cares about to discover, so it can notice each time you retrieve one of this crafted emails and what other emails are related to that. You could minimize this attack by not only fetching the emails that you care about, but fetch way more. But at the end or you have your whole set of emails locally or the server will be able to infer data about the encrypted emails.\n+\n+We reached the conclusion that the only privacy preserving way to access the email is to have the whole archive of the email locally accessible. We need to get back to the 90s.\n+\n+# Header Encryption and Signing with \"Memory Hole\"\n+\n+Contradicting user expectations now when an email arrives signed and/or encrypted your headers are not part of the signature or encryption. For example, that means when an email is signed and you are sure that it comes from the sender the subject could be replaced by an attacker changing completely the meaning of the email. Same happens with encryption, the headers are not protected and can be read by an attacker.\n+\n+For the last 6 months there has being ongoing conversations between most of OpenPGP email projects about securing email headers. The main project that is getting support by most of the clients is [Memory Hole](https://modernpgp.org/memoryhole/).\n+\n+Memory Hole aims to solve this problem by copying some headers in the PGP/MIME part so they get signed and/or encrypted. Some headers in case of encryption can be removed or replaced from the email headers to get privacy on them. One of the major problems about proposing a new format to secure headers is how to make it backward compatible so email clients of today (without Memory Hole support) can display the removed/replaced headers in a meaningful way to the user. Memory Hole proposes to solve that by placing the user facing headers in a MIME part so most of email clients today will render them on top of the body.","path":"pages/about-us/news/2015/2nd-openpgp-email-summit.md","position":28,"original_position":28,"commit_id":"4c77cd213434d302128d8d3626a1ab3f8deadb29","original_commit_id":"4c77cd213434d302128d8d3626a1ab3f8deadb29","user":{"login":"micah","id":2832,"avatar_url":"https://avatars.githubusercontent.com/u/2832?v=3","gravatar_id":"","url":"https://api.github.com/users/micah","html_url":"https://github.com/micah","followers_url":"https://api.github.com/users/micah/followers","following_url":"https://api.github.com/users/micah/following{/other_user}","gists_url":"https://api.github.com/users/micah/gists{/gist_id}","starred_url":"https://api.github.com/users/micah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/micah/subscriptions","organizations_url":"https://api.github.com/users/micah/orgs","repos_url":"https://api.github.com/users/micah/repos","events_url":"https://api.github.com/users/micah/events{/privacy}","received_events_url":"https://api.github.com/users/micah/received_events","type":"User","site_admin":false},"body":"from the email headers to protect their privacy...\r\n\r\nMIME part so most email clients today...","created_at":"2015-12-10T15:50:44Z","updated_at":"2015-12-10T15:50:44Z","html_url":"https://github.com/leapcode/leap_se/pull/9#discussion_r47242655","pull_request_url":"https://api.github.com/repos/leapcode/leap_se/pulls/9","_links":{"self":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/comments/47242655"},"html":{"href":"https://github.com/leapcode/leap_se/pull/9#discussion_r47242655"},"pull_request":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/9"}}},"pull_request":{"url":"https://api.github.com/repos/leapcode/leap_se/pulls/9","id":53189646,"html_url":"https://github.com/leapcode/leap_se/pull/9","diff_url":"https://github.com/leapcode/leap_se/pull/9.diff","patch_url":"https://github.com/leapcode/leap_se/pull/9.patch","issue_url":"https://api.github.com/repos/leapcode/leap_se/issues/9","number":9,"state":"open","locked":false,"title":"2nd OpenPGP Email Summit blogpots","user":{"login":"meskio","id":475542,"avatar_url":"https://avatars.githubusercontent.com/u/475542?v=3","gravatar_id":"","url":"https://api.github.com/users/meskio","html_url":"https://github.com/meskio","followers_url":"https://api.github.com/users/meskio/followers","following_url":"https://api.github.com/users/meskio/following{/other_user}","gists_url":"https://api.github.com/users/meskio/gists{/gist_id}","starred_url":"https://api.github.com/users/meskio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meskio/subscriptions","organizations_url":"https://api.github.com/users/meskio/orgs","repos_url":"https://api.github.com/users/meskio/repos","events_url":"https://api.github.com/users/meskio/events{/privacy}","received_events_url":"https://api.github.com/users/meskio/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-12-09T22:43:54Z","updated_at":"2015-12-10T15:50:45Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1e3b82a4f7fadd88bd0368987c5d52b7e24c8199","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/leapcode/leap_se/pulls/9/commits","review_comments_url":"https://api.github.com/repos/leapcode/leap_se/pulls/9/comments","review_comment_url":"https://api.github.com/repos/leapcode/leap_se/pulls/comments{/number}","comments_url":"https://api.github.com/repos/leapcode/leap_se/issues/9/comments","statuses_url":"https://api.github.com/repos/leapcode/leap_se/statuses/4c77cd213434d302128d8d3626a1ab3f8deadb29","head":{"label":"meskio:openpgp-summit","ref":"openpgp-summit","sha":"4c77cd213434d302128d8d3626a1ab3f8deadb29","user":{"login":"meskio","id":475542,"avatar_url":"https://avatars.githubusercontent.com/u/475542?v=3","gravatar_id":"","url":"https://api.github.com/users/meskio","html_url":"https://github.com/meskio","followers_url":"https://api.github.com/users/meskio/followers","following_url":"https://api.github.com/users/meskio/following{/other_user}","gists_url":"https://api.github.com/users/meskio/gists{/gist_id}","starred_url":"https://api.github.com/users/meskio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meskio/subscriptions","organizations_url":"https://api.github.com/users/meskio/orgs","repos_url":"https://api.github.com/users/meskio/repos","events_url":"https://api.github.com/users/meskio/events{/privacy}","received_events_url":"https://api.github.com/users/meskio/received_events","type":"User","site_admin":false},"repo":{"id":32153882,"name":"leap_se","full_name":"meskio/leap_se","owner":{"login":"meskio","id":475542,"avatar_url":"https://avatars.githubusercontent.com/u/475542?v=3","gravatar_id":"","url":"https://api.github.com/users/meskio","html_url":"https://github.com/meskio","followers_url":"https://api.github.com/users/meskio/followers","following_url":"https://api.github.com/users/meskio/following{/other_user}","gists_url":"https://api.github.com/users/meskio/gists{/gist_id}","starred_url":"https://api.github.com/users/meskio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meskio/subscriptions","organizations_url":"https://api.github.com/users/meskio/orgs","repos_url":"https://api.github.com/users/meskio/repos","events_url":"https://api.github.com/users/meskio/events{/privacy}","received_events_url":"https://api.github.com/users/meskio/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/meskio/leap_se","description":"The leap.se website.","fork":true,"url":"https://api.github.com/repos/meskio/leap_se","forks_url":"https://api.github.com/repos/meskio/leap_se/forks","keys_url":"https://api.github.com/repos/meskio/leap_se/keys{/key_id}","collaborators_url":"https://api.github.com/repos/meskio/leap_se/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/meskio/leap_se/teams","hooks_url":"https://api.github.com/repos/meskio/leap_se/hooks","issue_events_url":"https://api.github.com/repos/meskio/leap_se/issues/events{/number}","events_url":"https://api.github.com/repos/meskio/leap_se/events","assignees_url":"https://api.github.com/repos/meskio/leap_se/assignees{/user}","branches_url":"https://api.github.com/repos/meskio/leap_se/branches{/branch}","tags_url":"https://api.github.com/repos/meskio/leap_se/tags","blobs_url":"https://api.github.com/repos/meskio/leap_se/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/meskio/leap_se/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/meskio/leap_se/git/refs{/sha}","trees_url":"https://api.github.com/repos/meskio/leap_se/git/trees{/sha}","statuses_url":"https://api.github.com/repos/meskio/leap_se/statuses/{sha}","languages_url":"https://api.github.com/repos/meskio/leap_se/languages","stargazers_url":"https://api.github.com/repos/meskio/leap_se/stargazers","contributors_url":"https://api.github.com/repos/meskio/leap_se/contributors","subscribers_url":"https://api.github.com/repos/meskio/leap_se/subscribers","subscription_url":"https://api.github.com/repos/meskio/leap_se/subscription","commits_url":"https://api.github.com/repos/meskio/leap_se/commits{/sha}","git_commits_url":"https://api.github.com/repos/meskio/leap_se/git/commits{/sha}","comments_url":"https://api.github.com/repos/meskio/leap_se/comments{/number}","issue_comment_url":"https://api.github.com/repos/meskio/leap_se/issues/comments{/number}","contents_url":"https://api.github.com/repos/meskio/leap_se/contents/{+path}","compare_url":"https://api.github.com/repos/meskio/leap_se/compare/{base}...{head}","merges_url":"https://api.github.com/repos/meskio/leap_se/merges","archive_url":"https://api.github.com/repos/meskio/leap_se/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/meskio/leap_se/downloads","issues_url":"https://api.github.com/repos/meskio/leap_se/issues{/number}","pulls_url":"https://api.github.com/repos/meskio/leap_se/pulls{/number}","milestones_url":"https://api.github.com/repos/meskio/leap_se/milestones{/number}","notifications_url":"https://api.github.com/repos/meskio/leap_se/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/meskio/leap_se/labels{/name}","releases_url":"https://api.github.com/repos/meskio/leap_se/releases{/id}","created_at":"2015-03-13T12:10:27Z","updated_at":"2015-03-13T12:10:28Z","pushed_at":"2015-12-10T00:44:48Z","git_url":"git://github.com/meskio/leap_se.git","ssh_url":"git@github.com:meskio/leap_se.git","clone_url":"https://github.com/meskio/leap_se.git","svn_url":"https://github.com/meskio/leap_se","homepage":null,"size":1947,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"leapcode:master","ref":"master","sha":"a32e7019c88aeb297d0e60898b86b2d175f7ebe6","user":{"login":"leapcode","id":1700464,"avatar_url":"https://avatars.githubusercontent.com/u/1700464?v=3","gravatar_id":"","url":"https://api.github.com/users/leapcode","html_url":"https://github.com/leapcode","followers_url":"https://api.github.com/users/leapcode/followers","following_url":"https://api.github.com/users/leapcode/following{/other_user}","gists_url":"https://api.github.com/users/leapcode/gists{/gist_id}","starred_url":"https://api.github.com/users/leapcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leapcode/subscriptions","organizations_url":"https://api.github.com/users/leapcode/orgs","repos_url":"https://api.github.com/users/leapcode/repos","events_url":"https://api.github.com/users/leapcode/events{/privacy}","received_events_url":"https://api.github.com/users/leapcode/received_events","type":"Organization","site_admin":false},"repo":{"id":31005787,"name":"leap_se","full_name":"leapcode/leap_se","owner":{"login":"leapcode","id":1700464,"avatar_url":"https://avatars.githubusercontent.com/u/1700464?v=3","gravatar_id":"","url":"https://api.github.com/users/leapcode","html_url":"https://github.com/leapcode","followers_url":"https://api.github.com/users/leapcode/followers","following_url":"https://api.github.com/users/leapcode/following{/other_user}","gists_url":"https://api.github.com/users/leapcode/gists{/gist_id}","starred_url":"https://api.github.com/users/leapcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leapcode/subscriptions","organizations_url":"https://api.github.com/users/leapcode/orgs","repos_url":"https://api.github.com/users/leapcode/repos","events_url":"https://api.github.com/users/leapcode/events{/privacy}","received_events_url":"https://api.github.com/users/leapcode/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/leapcode/leap_se","description":"The leap.se website.","fork":false,"url":"https://api.github.com/repos/leapcode/leap_se","forks_url":"https://api.github.com/repos/leapcode/leap_se/forks","keys_url":"https://api.github.com/repos/leapcode/leap_se/keys{/key_id}","collaborators_url":"https://api.github.com/repos/leapcode/leap_se/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/leapcode/leap_se/teams","hooks_url":"https://api.github.com/repos/leapcode/leap_se/hooks","issue_events_url":"https://api.github.com/repos/leapcode/leap_se/issues/events{/number}","events_url":"https://api.github.com/repos/leapcode/leap_se/events","assignees_url":"https://api.github.com/repos/leapcode/leap_se/assignees{/user}","branches_url":"https://api.github.com/repos/leapcode/leap_se/branches{/branch}","tags_url":"https://api.github.com/repos/leapcode/leap_se/tags","blobs_url":"https://api.github.com/repos/leapcode/leap_se/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/leapcode/leap_se/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/leapcode/leap_se/git/refs{/sha}","trees_url":"https://api.github.com/repos/leapcode/leap_se/git/trees{/sha}","statuses_url":"https://api.github.com/repos/leapcode/leap_se/statuses/{sha}","languages_url":"https://api.github.com/repos/leapcode/leap_se/languages","stargazers_url":"https://api.github.com/repos/leapcode/leap_se/stargazers","contributors_url":"https://api.github.com/repos/leapcode/leap_se/contributors","subscribers_url":"https://api.github.com/repos/leapcode/leap_se/subscribers","subscription_url":"https://api.github.com/repos/leapcode/leap_se/subscription","commits_url":"https://api.github.com/repos/leapcode/leap_se/commits{/sha}","git_commits_url":"https://api.github.com/repos/leapcode/leap_se/git/commits{/sha}","comments_url":"https://api.github.com/repos/leapcode/leap_se/comments{/number}","issue_comment_url":"https://api.github.com/repos/leapcode/leap_se/issues/comments{/number}","contents_url":"https://api.github.com/repos/leapcode/leap_se/contents/{+path}","compare_url":"https://api.github.com/repos/leapcode/leap_se/compare/{base}...{head}","merges_url":"https://api.github.com/repos/leapcode/leap_se/merges","archive_url":"https://api.github.com/repos/leapcode/leap_se/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/leapcode/leap_se/downloads","issues_url":"https://api.github.com/repos/leapcode/leap_se/issues{/number}","pulls_url":"https://api.github.com/repos/leapcode/leap_se/pulls{/number}","milestones_url":"https://api.github.com/repos/leapcode/leap_se/milestones{/number}","notifications_url":"https://api.github.com/repos/leapcode/leap_se/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/leapcode/leap_se/labels{/name}","releases_url":"https://api.github.com/repos/leapcode/leap_se/releases{/id}","created_at":"2015-02-19T07:45:32Z","updated_at":"2015-09-04T06:10:51Z","pushed_at":"2015-12-10T00:44:48Z","git_url":"git://github.com/leapcode/leap_se.git","ssh_url":"git@github.com:leapcode/leap_se.git","clone_url":"https://github.com/leapcode/leap_se.git","svn_url":"https://github.com/leapcode/leap_se","homepage":null,"size":1934,"stargazers_count":3,"watchers_count":3,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8,"mirror_url":null,"open_issues_count":3,"forks":8,"open_issues":3,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/9"},"html":{"href":"https://github.com/leapcode/leap_se/pull/9"},"issue":{"href":"https://api.github.com/repos/leapcode/leap_se/issues/9"},"comments":{"href":"https://api.github.com/repos/leapcode/leap_se/issues/9/comments"},"review_comments":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/9/comments"},"review_comment":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/leapcode/leap_se/pulls/9/commits"},"statuses":{"href":"https://api.github.com/repos/leapcode/leap_se/statuses/4c77cd213434d302128d8d3626a1ab3f8deadb29"}}}}